Make WordPress Core

Opened 14 years ago

Closed 14 years ago

#11894 closed defect (bug) (fixed)

multisite permission checks should use caps when available

Reported by: denis-de-bernardy's profile Denis-de-Bernardy Owned by:
Milestone: 3.0 Priority: normal
Severity: critical Version: 3.0
Component: Multisite Keywords:
Focuses: Cc:

Description

r12722 introduces a bunch of checks such as:

if ( !is_multisite() || is_super_admin() )

they should be replaced with checks such as:

if ( current_user_can('install_plugins') )

Change History (7)

#1 @Denis-de-Bernardy
14 years ago

r12722 should really be reversed outright, even. this kind of change makes no sense whatsoever:

-  if ( current_user_can('update_themes') ) 
+  if ( ( !is_multisite() && current_user_can('update_themes') ) || is_super_admin() )

the actual meta cap check should be changed instead if needed, and mu sites should never grant update_themes to anyone *but* a super admin in the first place.

#2 follow-up: @wpmuguru
14 years ago

In MU only site admins can install plugins and themes.

The logic added keeps the existing WP logic when multisite is not enabled and enforces the existing MU permissions when multisite is enabled.

#3 in reply to: ↑ 2 @nacin
14 years ago

Replying to wpmuguru:

In MU only site admins can install plugins and themes.

The logic added keeps the existing WP logic when multisite is not enabled and enforces the existing MU permissions when multisite is enabled.

Right but map_meta_cap() should be used for this, is what Denis is saying. I'm pretty sure ryan added multisite-specific mapping for these capabilities already.

#4 @ryan
14 years ago

I added them. caps that should be removed from regular admins when multisite is enabled are now removed by map_meta_cap. It does the multisite and superadmun check for you.

#5 @wpmuguru
14 years ago

(In [12724]) revert permission check in [12722], props ddebernardy, See #11894

#6 @ryan
14 years ago

I changed several more to caps for #11644.

#7 @ryan
14 years ago

  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.