Ticket #16501: 16501.diff

wp-admin/users.php

@@ -48 +48 @@
 case 'promote':
         check_admin_referer('bulk-users');
 
+        if ( ! current_user_can( 'promote_users' ) )
+                wp_die( __( 'You can’t edit that user.' ) );
+
         if ( empty($_REQUEST['users']) ) {
                 wp_redirect($redirect);
                 exit();

wp-admin/includes/class-wp-users-list-table.php

@@ -132 +132 @@
         function extra_tablenav( $which ) {
                 if ( 'top' != $which )
                         return;
+                if ( ! current_user_can( 'promote_users' ) )
+                        return;
 ?>
         <div class="alignleft actions">
                 <label class="screen-reader-text" for="new_role"><?php _e( 'Change role to&hellip;' ) ?></label>

wp-admin/menu.php

@@ -191 +191 @@
 if ( current_user_can('list_users') ) {
         $_wp_real_parent_file['profile.php'] = 'users.php'; // Back-compat for plugins adding submenus to profile.php.
         $submenu['users.php'][5] = array(__('Users'), 'list_users', 'users.php');
-        $submenu['users.php'][10] = array(_x('Add New', 'user'), 'promote_users', 'user-new.php');
+        if ( current_user_can('create_users') )
+                $submenu['users.php'][10] = array(_x('Add New', 'user'), 'create_users', 'user-new.php');
+        else
+                $submenu['users.php'][10] = array(_x('Add New', 'user'), 'promote_users', 'user-new.php');
 
         $submenu['users.php'][15] = array(__('Your Profile'), 'read', 'profile.php');
 } else {
         $_wp_real_parent_file['users.php'] = 'profile.php';
         $submenu['profile.php'][5] = array(__('Your Profile'), 'read', 'profile.php');
-        $submenu['profile.php'][10] = array(__('Add New User'), 'promote_users', 'user-new.php');
+        if ( current_user_can('create_users') )
+                $submenu['profile.php'][10] = array(__('Add New User'), 'create_users', 'user-new.php');
+        else
+                $submenu['profile.php'][10] = array(__('Add New User'), 'promote_users', 'user-new.php');
 }
 
 $menu[75] = array( __('Tools'), 'edit_posts', 'tools.php', '', 'menu-top menu-icon-tools', 'menu-tools', 'div' );