Changeset 32173 for trunk/src/wp-includes/capabilities.php

Timestamp:

04/20/2015 07:26:05 AM (11 years ago)

Author:

pento

Message:

In Multisite, prevent plugins from unintentionally switching sites.

Props mdawaffe.

File:

• trunk/src/wp-includes/capabilities.php (modified) (2 diffs)

trunk/src/wp-includes/capabilities.php

@@ -1404 +1404 @@
  */
 function current_user_can_for_blog( $blog_id, $capability ) {
-        if ( is_multisite() )
-                switch_to_blog( $blog_id );
+        $switched = is_multisite() ? switch_to_blog( $blog_id ) : false;
 
         $current_user = wp_get_current_user();
 
-        if ( empty( $current_user ) )
+        if ( empty( $current_user ) ) {
+                if ( $switched ) {
+                        restore_current_blog();
+                }
                 return false;
+        }
 
         $args = array_slice( func_get_args(), 2 );
@@ -1417 +1420 @@
         $can = call_user_func_array( array( $current_user, 'has_cap' ), $args );
 
-        if ( is_multisite() )
+        if ( $switched ) {
                 restore_current_blog();
+        }
 
         return $can;