WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 4 years ago

#11894 closed defect (bug) (fixed)

multisite permission checks should use caps when available

Reported by: Denis-de-Bernardy Owned by:
Milestone: 3.0 Priority: normal
Severity: critical Version: 3.0
Component: Multisite Keywords:
Focuses: Cc:

Description

r12722 introduces a bunch of checks such as:

if ( !is_multisite() || is_super_admin() )

they should be replaced with checks such as:

if ( current_user_can('install_plugins') )

Change History (7)

comment:1 Denis-de-Bernardy4 years ago

r12722 should really be reversed outright, even. this kind of change makes no sense whatsoever:

-  if ( current_user_can('update_themes') ) 
+  if ( ( !is_multisite() && current_user_can('update_themes') ) || is_super_admin() )

the actual meta cap check should be changed instead if needed, and mu sites should never grant update_themes to anyone *but* a super admin in the first place.

comment:2 follow-up: wpmuguru4 years ago

In MU only site admins can install plugins and themes.

The logic added keeps the existing WP logic when multisite is not enabled and enforces the existing MU permissions when multisite is enabled.

comment:3 in reply to: ↑ 2 nacin4 years ago

Replying to wpmuguru:

In MU only site admins can install plugins and themes.

The logic added keeps the existing WP logic when multisite is not enabled and enforces the existing MU permissions when multisite is enabled.

Right but map_meta_cap() should be used for this, is what Denis is saying. I'm pretty sure ryan added multisite-specific mapping for these capabilities already.

comment:4 ryan4 years ago

I added them. caps that should be removed from regular admins when multisite is enabled are now removed by map_meta_cap. It does the multisite and superadmun check for you.

comment:5 wpmuguru4 years ago

(In [12724]) revert permission check in [12722], props ddebernardy, See #11894

comment:6 ryan4 years ago

I changed several more to caps for #11644.

comment:7 ryan4 years ago

  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.