Ticket #16293: 16293.diff

wp-admin/includes/class-wp-ms-users-list-table.php

@@ -188 +188 @@
                                                                 $actions = array();
                                                                 $actions['edit'] = '<a href="' . $edit_link . '">' . __( 'Edit' ) . '</a>';
 
-                                                                if ( current_user_can( 'delete_user', $user->ID) && ! in_array( $user->user_login, $super_admins ) ) {
+                                                                if ( current_user_can( 'delete_user', $user->ID) && $user->user_email != get_site_option( 'admin_email' ) && $user->ID != get_current_user_id() && count( $super_admins ) > 1 ) {
                                                                         $actions['delete'] = '<a href="' . $delete = esc_url( network_admin_url( add_query_arg( '_wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), wp_nonce_url( 'edit.php', 'deleteuser' ) . '&amp;action=deleteuser&amp;id=' . $user->ID ) ) ) . '" class="delete">' . __( 'Delete' ) . '</a>';
                                                                 }
 

wp-admin/includes/ms.php

@@ -140 +140 @@
 
         $id = (int) $id;
 
+        if ( is_super_admin( $id ) )
+                if ( ! revoke_super_admin( $id ) )
+                        return false;
+
         do_action( 'wpmu_delete_user', $id );
 
         $blogs = get_blogs_of_user( $id );
@@ -165 +169 @@
                         restore_current_blog();
                 }
         }
-
+        
         $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->users WHERE ID = %d", $id ) );
         $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->usermeta WHERE user_id = %d", $id ) );
 

wp-admin/network/edit.php

@@ -22 +22 @@
         $current_user = wp_get_current_user();
         if ( !is_array( $users ) )
                 return false;
-
         screen_icon();
         ?>
         <h2><?php esc_html_e( 'Users' ); ?></h2>
+        <?php ob_start(); ?>
         <p><?php _e( 'Transfer or delete posts and links before deleting users.' ); ?></p>
         <form action="edit.php?action=dodelete" method="post">
         <input type="hidden" name="dodelete" />
         <?php
         wp_nonce_field( 'ms-users-delete' );
         $site_admins = get_super_admins();
+        $site_admin_count = count( $site_admins );
         $admin_out = "<option value='$current_user->ID'>$current_user->user_login</option>";
 
         foreach ( ( $allusers = (array) $_POST['allusers'] ) as $key => $val ) {
@@ -41 +42 @@
                         if ( ! current_user_can( 'delete_user', $delete_user->ID ) )
                                 wp_die( sprintf( __( 'Warning! User %s cannot be deleted.' ), $delete_user->user_login ) );
 
-                        if ( in_array( $delete_user->user_login, $site_admins ) )
-                                wp_die( sprintf( __( 'Warning! User cannot be deleted. The user %s is a network admnistrator.' ), $delete_user->user_login ) );
+                        if ( in_array( $delete_user->user_login, $site_admins ) ) {
+                                $site_admin_count --;
+
+                                if ( $site_admin_count < 1 ) {
+                                        ob_end_clean(); // don't even output the form
+                                        wp_die( __( 'You cannot delete all super admins.' ) );
+                                }
+                        }
 
                         echo "<input type='hidden' name='user[]' value='{$val}'/>\n";
                         $blogs = get_blogs_of_user( $val, true );
@@ -85 +92 @@
         ?>
         </form>
     <?php
+        echo ob_get_clean();
         return true;
 }
 
@@ -356 +364 @@
 
                 check_admin_referer( 'deleteuser' );
 
-                if ( $id != '0' && $id != '1' ) {
+                $user = get_userdata( $id );
+
+                if ( ! is_super_admin( $id ) || ( $user->user_email != get_site_option( 'admin_email' ) && get_current_user_id() != $id && count( get_super_admins() ) > 1 ) ) {
                         $_POST['allusers'] = array( $id ); // confirm_delete_users() can only handle with arrays
                         $title = __( 'Users' );
                         $parent_file = 'users.php';