Changeset 40993 for trunk/src/wp-includes/class-wp-user.php

Timestamp:

07/02/2017 05:15:42 AM (8 years ago)

Author:

peterwilsoncc

Message:

Capabilities: Prevent users having the do_not_allow capability.

Meta capabilities use the capability do_not_allow to indicate a user should be blocked from performing a particular action. This ensures users can not have the capability as it would cause unexpected behaviour.

Props johnbillion.
Fixes #41059.

File:

• trunk/src/wp-includes/class-wp-user.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-user.php

@@ -749 +749 @@
         $capabilities['exist'] = true;
 
+        // Nobody is allowed to do things they are not allowed to do.
+        unset( $capabilities['do_not_allow'] );
+
         // Must have ALL requested caps.
         foreach ( (array) $caps as $cap ) {