Ticket #12109: 12109.diff

wp-includes/capabilities.php

@@ -722 +722 @@
                         $cap = $this->translate_level_to_cap( $cap );
                 }
 
-                // Multisite super admin has all caps by definition.
-                if ( is_multisite() && is_super_admin() )
-                        return true;
-
                 $args = array_slice( func_get_args(), 1 );
                 $args = array_merge( array( $cap, $this->ID ), $args );
                 $caps = call_user_func_array( 'map_meta_cap', $args );
+
+                // Multisite super admin has all caps by definition, Unless specifically denied.
+                if ( is_multisite() && is_super_admin() ) {
+                        if ( in_array('do_not_allow', $caps) )
+                                return false;
+                        return true;
+                }
+
                 // Must have ALL requested caps
                 $capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args );
                 foreach ( (array) $caps as $cap ) {
@@ -1027 +1031 @@
 function current_user_can( $capability ) {
         $current_user = wp_get_current_user();
 
-    if ( is_multisite() && is_super_admin() )
-                return true;
-
         if ( empty( $current_user ) )
                 return false;