Changeset 33988

Timestamp:

09/10/2015 03:33:22 AM (9 years ago)

Author:

jeremyfelt

Message:

Multisite: Allow users with manage_network_users to edit network users.

Other users in a network can now be given capabilities to manage users without also having global super admin privileges.

• Users with manage_network_users can not edit super admins.
• Users with manage_network_users can not promote users to super admin.
• Uses of is_super_admin() in user-new.php are now updated to manage_network_users.

Props daniellandau, chriscct7.
Fixes #16860.

Location:

trunk

Files:

• src/wp-admin/user-new.php (modified) (4 diffs)
• src/wp-includes/capabilities-functions.php (modified) (1 diff)
• tests/phpunit/tests/user/capabilities.php (modified) (1 diff)

trunk/src/wp-admin/user-new.php

@@ -85 +85 @@
         $redirect = add_query_arg( array('update' => 'addexisting'), 'user-new.php' );
     } else {
-        if ( isset( $_POST[ 'noconfirmation' ] ) && is_super_admin() ) {
+        if ( isset( $_POST[ 'noconfirmation' ] ) && current_user_can( 'manage_network_users' ) ) {
             add_existing_user_to_blog( array( 'user_id' => $user_id, 'role' => $_REQUEST[ 'role' ] ) );
             $redirect = add_query_arg( array('update' => 'addnoconfirmation'), 'user-new.php' );
@@ -159 +159 @@
              */
             $new_user_login = apply_filters( 'pre_user_login', sanitize_user( wp_unslash( $_REQUEST['user_login'] ), true ) );
-            if ( isset( $_POST[ 'noconfirmation' ] ) && is_super_admin() ) {
+            if ( isset( $_POST[ 'noconfirmation' ] ) && current_user_can( 'manage_network_users' ) ) {
                 add_filter( 'wpmu_signup_user_notification', '__return_false' ); // Disable confirmation email
                 add_filter( 'wpmu_welcome_user_notification', '__return_false' ); // Disable welcome email
             }
             wpmu_signup_user( $new_user_login, $new_user_email, array( 'add_to_blog' => $wpdb->blogid, 'new_role' => $_REQUEST['role'] ) );
-            if ( isset( $_POST[ 'noconfirmation' ] ) && is_super_admin() ) {
+            if ( isset( $_POST[ 'noconfirmation' ] ) && current_user_can( 'manage_network_users' ) ) {
                 $key = $wpdb->get_var( $wpdb->prepare( "SELECT activation_key FROM {$wpdb->signups} WHERE user_login = %s AND user_email = %s", $new_user_login, $new_user_email ) );
                 wpmu_activate_signup( $key );
@@ -340 +340 @@
         </td>
     </tr>
-<?php if ( is_super_admin() ) { ?>
+<?php if ( current_user_can( 'manage_network_users' ) ) { ?>
     <tr>
         <th scope="row"><label for="adduser-noconfirmation"><?php _e('Skip Confirmation Email') ?></label></th>
@@ -477 +477 @@
         </td>
     </tr>
-    <?php if ( is_multisite() && is_super_admin() ) { ?>
+    <?php if ( is_multisite() && current_user_can( 'manage_network_users' ) ) { ?>
     <tr>
         <th scope="row"><label for="noconfirmation"><?php _e('Skip Confirmation Email') ?></label></th>

trunk/src/wp-includes/capabilities-functions.php

@@ -38 +38 @@
             break;
 
-        // If multisite these caps are allowed only for super admins.
-        if ( is_multisite() && !is_super_admin( $user_id ) )
-            $caps[] = 'do_not_allow';
-        else
+        // In multisite the user must have manage_network_users caps. If editing a super admin, the user must be a super admin.
+        if ( is_multisite() && ( ( ! is_super_admin( $user_id ) && 'edit_user' === $cap && is_super_admin( $args[0] ) ) || ! user_can( $user_id, 'manage_network_users' ) ) ) {
+            $caps[] = 'do_not_allow';
+        } else {
             $caps[] = 'edit_users'; // edit_user maps to edit_users.
+        }
         break;
     case 'delete_post':

trunk/tests/phpunit/tests/user/capabilities.php

@@ -964 +964 @@
         $this->assertTrue( current_user_can( 'edit_user', $user->ID ) );
     }
+
+    function test_multisite_administrator_with_manage_network_users_can_edit_users() {
+        if ( ! is_multisite() ) {
+            $this->markTestSkipped( 'Test only runs in multisite' );
+            return;
+        }
+
+        $user = new WP_User( $this->factory->user->create( array( 'role' => 'administrator' ) ) );
+        $user->add_cap( 'manage_network_users' );
+        $other_user = new WP_User( $this->factory->user->create( array( 'role' => 'subscriber' ) ) );
+
+        wp_set_current_user( $user->ID );
+
+        $this->assertTrue( current_user_can( 'edit_user', $other_user->ID ) );
+    }
+
+    function test_multisite_administrator_with_manage_network_users_can_not_edit_super_admin() {
+        if ( ! is_multisite() ) {
+            $this->markTestSkipped( 'Test only runs in multisite' );
+            return;
+        }
+
+        $user = new WP_User( $this->factory->user->create( array( 'role' => 'administrator' ) ) );
+        $user->add_cap( 'manage_network_users' );
+        $super_admin = new WP_User( $this->factory->user->create( array( 'role' => 'subscriber' ) ) );
+        grant_super_admin( $super_admin->ID );
+
+        wp_set_current_user( $user->ID );
+
+        $this->assertFalse( current_user_can( 'edit_user', $super_admin->ID ) );
+    }
 }