Changeset 14011

Timestamp:

04/05/2010 10:28:21 PM (15 years ago)

Author:

wpmuguru

Message:

add permission checks to grant/revoke_super_admin(), see #12109, related #12460

File:

• trunk/wp-admin/includes/ms.php (modified) (2 diffs)

trunk/wp-admin/includes/ms.php

@@ -808 +808 @@
  */
 function grant_super_admin( $user_id ) {
+    global $current_user;
+
+    if ( $current_user->ID == $user_id || !current_user_can( 'manage_network_options' ) )
+        return;
+
     $super_admins = get_site_option( 'site_admins', array( 'admin' ) );
 
@@ -824 +829 @@
  */
 function revoke_super_admin( $user_id ) {
+    global $current_user;
+
+    if ( $current_user->ID == $user_id || !current_user_can( 'manage_network_options' ) )
+        return;
+
     $super_admins = get_site_option( 'site_admins', array( 'admin' ) );
+    if ( count( $super_admins ) < 2 )
+        return;
+
     $admin_email = get_site_option( 'admin_email' );