Changeset 13463
- Timestamp:
- 02/27/2010 06:07:25 PM (16 years ago)
- File:
-
- 1 edited
-
trunk/wp-admin/includes/user.php (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
-
trunk/wp-admin/includes/user.php
r13377 r13463 77 77 if ( isset( $_POST['role'] ) && current_user_can( 'edit_users' ) ) { 78 78 $new_role = sanitize_text_field( $_POST['role'] ); 79 $potential_role = isset($wp_roles->role_objects[$new_role]) ? $wp_roles->role_objects[$new_role] : false; 79 80 // Don't let anyone with 'edit_users' (admins) edit their own role to something without it. 80 if ( $user_id != $current_user->id || $wp_roles->role_objects[$new_role]->has_cap( 'edit_users' ))81 if ( $user_id != $current_user->id || ($potential_role && $potential_role->has_cap( 'edit_users' ) ) ) 81 82 $user->role = $new_role; 82 83
Note: See TracChangeset
for help on using the changeset viewer.