Changeset 14256

Timestamp:

04/27/2010 08:39:39 PM (16 years ago)

Author:

nacin

Message:

Explicitly set the capability required in edit_users map_meta_cap branch, so we don't accidentally pass edit_user. props TheDeadMedic. fixes #13074, fixes #13137

File:

• trunk/wp-includes/capabilities.php (modified) (2 diffs)

trunk/wp-includes/capabilities.php

@@ -783 +783 @@
  * This does not actually compare whether the user ID has the actual capability,
  * just what the capability or capabilities are. Meta capability list value can
- * be 'delete_user', 'edit_user', 'delete_post', 'delete_page', 'edit_post',
- * 'edit_page', 'read_post', or 'read_page'.
+ * be 'delete_user', 'edit_user', 'remove_user', 'promote_user', 'delete_post',
+ * 'delete_page', 'edit_post', 'edit_page', 'read_post', or 'read_page'.
  *
  * @since 2.0.0
@@ -816 +816 @@
             $caps[] = 'do_not_allow';
         else
-            $caps[] = $cap;
+            $caps[] = 'edit_users'; // Explicit due to primitive fall through
         break;
     case 'delete_post':