Changeset 60976

Timestamp:

10/19/2025 05:18:55 PM (12 months ago)

Author:

johnjamesjacoby

Message:

Networks and Sites: prevent a PHP error in wp-admin/network/site-users.php.

This change brings the multisite specific promote user action up-to-speed with the single-site one, by adding:

• capability checks where appropriate
• a none check on $role to set it to an empty string

It also updates the inline documentation of the single-site promote user action in users.php, to match the suggested additions to the multisite file.

Props ignatiusjeroe, jeremyfelt, johnjamesjacoby, pratiklondhe, shanemuir, sudipatel007, techpartho.

Fixes #61100.

Location:

trunk/src/wp-admin

Files:

• network/site-users.php (modified) (3 diffs)
• users.php (modified) (2 diffs)

trunk/src/wp-admin/network/site-users.php

@@ -140 +140 @@
                 case 'promote':
                         check_admin_referer( 'bulk-users' );
+
+                        if ( ! current_user_can( 'promote_users' ) ) {
+                                wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 );
+                        }
+
                         $editable_roles = get_editable_roles();
                         $role           = $_REQUEST['new_role'];
 
+                        // Mock `none` as editable role.
+                        $editable_roles['none'] = array(
+                                'name' => __( '— No role for this site —' ),
+                        );
+
                         if ( empty( $editable_roles[ $role ] ) ) {
                                 wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );
+                        }
+
+                        if ( 'none' === $role ) {
+                                $role = '';
                         }
 
@@ -152 +166 @@
                                 foreach ( $userids as $user_id ) {
                                         $user_id = (int) $user_id;
+
+                                        if ( ! current_user_can( 'promote_user', $user_id ) ) {
+                                                wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 );
+                                        }
 
                                         // If the user doesn't already belong to the blog, bail.
@@ -163 +181 @@
 
                                         $user = get_userdata( $user_id );
+
+                                        // If $role is empty, none will be set.
                                         $user->set_role( $role );
                                 }

trunk/src/wp-admin/users.php

@@ -123 +123 @@
                 $role           = $_REQUEST['new_role'];
 
-                // Mocking the `none` role so we are able to save it to the database
+                // Mock `none` as editable role.
                 $editable_roles['none'] = array(
                         'name' => __( '— No role for this site —' ),
@@ -163 +163 @@
 
                         $user = get_userdata( $id );
+
+                        // If $role is empty, none will be set.
                         $user->set_role( $role );
                 }