Changeset 32173 for trunk/src/wp-includes/capabilities.php

Timestamp:

04/20/2015 07:26:05 AM (10 years ago)

Author:

pento

Message:

In Multisite, prevent plugins from unintentionally switching sites.

Props mdawaffe.

File:

• trunk/src/wp-includes/capabilities.php (modified) (2 diffs)

trunk/src/wp-includes/capabilities.php

@@ -1404 +1404 @@
  */
 function current_user_can_for_blog( $blog_id, $capability ) {
-    if ( is_multisite() )
-        switch_to_blog( $blog_id );
+    $switched = is_multisite() ? switch_to_blog( $blog_id ) : false;
 
     $current_user = wp_get_current_user();
 
-    if ( empty( $current_user ) )
+    if ( empty( $current_user ) ) {
+        if ( $switched ) {
+            restore_current_blog();
+        }
         return false;
+    }
 
     $args = array_slice( func_get_args(), 2 );
@@ -1417 +1420 @@
     $can = call_user_func_array( array( $current_user, 'has_cap' ), $args );
 
-    if ( is_multisite() )
+    if ( $switched ) {
         restore_current_blog();
+    }
 
     return $can;