Ticket #36376: fix.36376.diff

wp-includes/class-wp-user.php

@@ -482 +482 @@
                 if ( is_array( $this->caps ) )
                         $this->roles = array_filter( array_keys( $this->caps ), array( $wp_roles, 'is_role' ) );
 
-                //Build $allcaps from role caps, overlay user's $caps
+                /**
+                 * Build $allcaps from role caps, overlaying user's $caps and caps from
+                 * the user's roles. Role capabilities are filtered to only return caps
+                 * which are true. This prevents false caps overwriting true caps.
+                 */
                 $this->allcaps = array();
                 foreach ( (array) $this->roles as $role ) {
                         $the_role = $wp_roles->get_role( $role );
-                        $this->allcaps = array_merge( (array) $this->allcaps, (array) $the_role->capabilities );
+                        $this->allcaps = array_merge( (array) $this->allcaps, array_filter( (array) $the_role->capabilities ) );
                 }
                 $this->allcaps = array_merge( (array) $this->allcaps, (array) $this->caps );