Ticket #19791: patch.diff

wp-includes/capabilities.php

@@ -1112 +1112 @@
                 else
                         $caps[] = 'do_not_allow';
                 break;
+        case 'delete_user':
+        case 'delete_users':
+                // If multisite these caps are allowed only for super admins.
+                if ( is_multisite() && !is_super_admin( $user_id ) ) {
+                        $caps[] = 'do_not_allow';
+                } else {
+                        if ( 'delete_user' == $cap )
+                                $cap = 'delete_users';
+                        $caps[] = $cap;
+                }
+                break;
+        case 'create_users':
+                if ( !is_multisite() )
+                        $caps[] = $cap;
+                elseif ( is_super_admin() || get_site_option( 'add_new_users' ) )
+                        $caps[] = $cap;
+                else
+                        $caps[] = 'do_not_allow';
+                break;
         case 'edit_files':
         case 'edit_plugins':
         case 'edit_themes':
                 if ( defined('DISALLOW_FILE_EDIT') && DISALLOW_FILE_EDIT ) {
                         $caps[] = 'do_not_allow';
-                        break;
-                }
-                // Fall through if not DISALLOW_FILE_EDIT.
+                }else{
+                        $caps[] = $cap;
+                }
+                break;
         case 'update_plugins':
         case 'delete_plugins':
         case 'install_plugins':
@@ -1131 +1151 @@
                 // Files in uploads are excepted.
                 if ( defined('DISALLOW_FILE_MODS') && DISALLOW_FILE_MODS ) {
                         $caps[] = 'do_not_allow';
-                        break;
-                }
-                // Fall through if not DISALLOW_FILE_MODS.
+                }else{
+                        $caps[] = $cap;
+                }
+                break;
         case 'unfiltered_html':
                 // Disallow unfiltered_html for all users, even admins and super admins.
                 if ( defined('DISALLOW_UNFILTERED_HTML') && DISALLOW_UNFILTERED_HTML ) {
                         $caps[] = 'do_not_allow';
-                        break;
-                }
-                // Fall through if not DISALLOW_UNFILTERED_HTML
-        case 'delete_user':
-        case 'delete_users':
-                // If multisite these caps are allowed only for super admins.
-                if ( is_multisite() && !is_super_admin( $user_id ) ) {
-                        $caps[] = 'do_not_allow';
-                } else {
-                        if ( 'delete_user' == $cap )
-                                $cap = 'delete_users';
-                        $caps[] = $cap;
-                }
-                break;
-        case 'create_users':
-                if ( !is_multisite() )
-                        $caps[] = $cap;
-                elseif ( is_super_admin() || get_site_option( 'add_new_users' ) )
-                        $caps[] = $cap;
-                else
-                        $caps[] = 'do_not_allow';
-                break;
+
+                }else{
+                        $caps[] = $cap;
+                }
+                break;
         default:
                 // Handle meta capabilities for custom post types.
                 $post_type_meta_caps = _post_type_meta_capabilities();