Changeset 42855 for trunk/src/wp-admin/includes/user.php

Timestamp:

03/19/2018 08:28:28 PM (8 years ago)

Author:

ocean90

Message:

Users: Use promote_users for role updates in edit_user().

edit_user() can also update user roles but was still using the edit_users capability instead of the newer promote_users capability introduced in [14176].
This makes the role handling consistent with the bulk dropdown menu for role changes.

Props flixos90, johnjamesjacoby, ocean90.
Fixes #42564.

File:

• trunk/src/wp-admin/includes/user.php (modified) (2 diffs)

trunk/src/wp-admin/includes/user.php

@@ -31 +31 @@
     $wp_roles = wp_roles();
     $user     = new stdClass;
+    $user_id  = (int) $user_id;
     if ( $user_id ) {
         $update           = true;
-        $user->ID         = (int) $user_id;
+        $user->ID         = $user_id;
         $userdata         = get_userdata( $user_id );
         $user->user_login = wp_slash( $userdata->user_login );
@@ -52 +53 @@
     }
 
-    if ( isset( $_POST['role'] ) && current_user_can( 'edit_users' ) ) {
-        $new_role       = sanitize_text_field( $_POST['role'] );
-        $potential_role = isset( $wp_roles->role_objects[ $new_role ] ) ? $wp_roles->role_objects[ $new_role ] : false;
-        // Don't let anyone with 'edit_users' (admins) edit their own role to something without it.
-        // Multisite super admins can freely edit their blog roles -- they possess all caps.
-        if ( ( is_multisite() && current_user_can( 'manage_sites' ) ) || $user_id != get_current_user_id() || ( $potential_role && $potential_role->has_cap( 'edit_users' ) ) ) {
-            $user->role = $new_role;
-        }
-
-        // If the new role isn't editable by the logged-in user die with error
+    if ( isset( $_POST['role'] ) && current_user_can( 'promote_users' ) && ( ! $user_id || current_user_can( 'promote_user', $user_id ) ) ) {
+        $new_role = sanitize_text_field( $_POST['role'] );
+
+        // If the new role isn't editable by the logged-in user die with error.
         $editable_roles = get_editable_roles();
         if ( ! empty( $new_role ) && empty( $editable_roles[ $new_role ] ) ) {
             wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );
+        }
+
+        $potential_role = isset( $wp_roles->role_objects[ $new_role ] ) ? $wp_roles->role_objects[ $new_role ] : false;
+
+        /*
+         * Don't let anyone with 'promote_users' edit their own role to something without it.
+         * Multisite super admins can freely edit their roles, they possess all caps.
+         */
+        if (
+            ( is_multisite() && current_user_can( 'manage_network_users' ) ) ||
+            $user_id !== get_current_user_id() ||
+            ( $potential_role && $potential_role->has_cap( 'promote_users' ) )
+        ) {
+            $user->role = $new_role;
         }
     }