function map_meta_cap does not use the user ID when checking super admin

[dlo]

The function map_meta_cap in capabilities.php is checking for super admins in various places like:

case 'edit_users':
		// If multisite these caps are allowed only for super admins.
		if ( is_multisite() && !is_super_admin() )
			$caps[] = 'do_not_allow';
		else
			$caps[] = 'edit_users'; // Explicit due to primitive fall through
		break;

or

case 'delete_user':
	case 'delete_users':
		// If multisite these caps are allowed only for super admins.
		if ( is_multisite() && !is_super_admin() )
			$caps[] = 'do_not_allow';
		else
			$caps[] = $cap;
		break;

In both cases, the function is_super_admin is used without any parameter. That leads to check if the currently connected user is a super admin and not the user passed to the function map_meta_cap.

In my opinion, this is a bug and the correct code should be:

case 'edit_users':
		// If multisite these caps are allowed only for super admins.
		if ( is_multisite() && !is_super_admin($user_id) )
			$caps[] = 'do_not_allow';
		else
			$caps[] = 'edit_users'; // Explicit due to primitive fall through
		break;

and

case 'delete_user':
	case 'delete_users':
		// If multisite these caps are allowed only for super admins.
		if ( is_multisite() && !is_super_admin($user_id) )
			$caps[] = 'do_not_allow';
		else
			$caps[] = $cap;
		break;

I am right ?

[tmoorewp]

Here's the changes in patch form.

[nacin]

(In [15479]) Ensure we're checking when looking for is_super_admin() in map_meta_cap(). Bump DB version.
fixes #14454 for the 3.0.1 tag.

[nacin]

(In [15480]) Ensure we're checking when looking for is_super_admin() in map_meta_cap(). Bump DB version.
fixes #14454 for trunk.

[nacin]

Additionally [15479] for the branch.

Sorry tmoorewp about the props. We scrambled to get this into 3.0.1 and I didn't notice you had a patch here.

[tmoorewp]

Replying to nacin:

Additionally [15479] for the branch.

Sorry tmoorewp about the props. We scrambled to get this into 3.0.1 and I didn't notice you had a patch here.

No worries!

Tim