Ticket #36376: for36376.diff

src/wp-includes/class-wp-user.php

@@ -486 +486 @@
          *
          * @return array List of all capabilities for the user.
          */
-        public function get_role_caps() {
+         public function get_role_caps() {
                 $switch_site = false;
                 if ( is_multisite() && $this->site_id != get_current_blog_id() ) {
                         $switch_site = true;
@@ -494 +494 @@
                         switch_to_blog( $this->site_id );
                 }
 
-                $wp_roles = wp_roles();
+                $wp_roles = wp_roles();
 
-                // Filter out caps that are not role names and assign to $this->roles.
-                if ( is_array( $this->caps ) ) {
-                        $this->roles = array_filter( array_keys( $this->caps ), array( $wp_roles, 'is_role' ) );
+                // Filter out caps that are not role names and assign to $this->roles.
+                if ( is_array( $this->caps ) ) {
+                        $this->roles = array_filter( array_keys( $this->caps ), array( $wp_roles, 'is_role' ) );
                 }
 
-                // Build $allcaps from role caps, overlay user's $caps.
-                $this->allcaps = array();
-                foreach ( (array) $this->roles as $role ) {
-                        $the_role      = $wp_roles->get_role( $role );
-                        $this->allcaps = array_merge( (array) $this->allcaps, (array) $the_role->capabilities );
-                }
-                $this->allcaps = array_merge( (array) $this->allcaps, (array) $this->caps );
+                // Build $allcaps from role caps, overlay user's $caps.
+                $this->allcaps = array();
+                foreach ( (array) $this->roles as $role ) {
+                        $the_role = $wp_roles->get_role( $role );
 
+                        /*
+                         * Merge role capabilities.
+                         * Have to use this approach, instead of array_merge,
+                         * to make sure a "0" in one role doesn't overwrite a "1" on another.
+                         */
+                        foreach( (array) $the_role->capabilities as $cap => $value ) {
+                                if ( ! isset( $this->allcaps[ $cap ] ) || ( ! $this->allcaps[ $cap ] && $value ) ) {
+                                        $this->allcaps[ $cap ] = $value;
+                                }
+                        }
+                }
+
+                // Merge role capabilities.
+                foreach( (array) $this->caps as $cap => $value ) {
+                        if ( ! isset( $this->allcaps[ $cap ] ) || ( ! $this->allcaps[ $cap ] && $value ) ) {
+                                $this->allcaps[ $cap ] = $value;
+                        }
+                }
+
                 if ( $switch_site ) {
                         restore_current_blog();
                 }
 
-                return $this->allcaps;
-        }
+                return $this->allcaps;
+        }
 
         /**
          * Add role to user.