Users list 'Change role to' allows for changing logged-in Admin role to Subscriber

[raamdev]

While it's not possible for an Administrator to change his or her own role to Subscriber from the Edit Profile page (the drop-down doesn't exist for logged-in Admins), it is possible to change your own role to Subscriber from within the Users list by using the 'Change role to...' drop-down.

This would allow an Administrator to inadvertently lock themselves out of WordPress if they forget to uncheck their account in the list when making bulk updates.

To recreate this issue, first create an additional Administrator account so you can get back in. Then from the Users list, select your current Administrator account (i.e., the one you're logged in with) and then choose 'Change role to' -> Subscriber.

You'll immediately be kicked out of the Admin panel. (Now you can login with the other Admin account and change your role back to Administrator.)

[linuxologos]

Introduced in [19024] for #18164.

[nacin]

I must have thought that was in an is_multisite() block. Logic fix should be simple.

[nacin]

In [19640]:

Only allow _multisite_ super admins to demote themselves on a site. props linuxologos, see #19684 for trunk.

[nacin]

Marking as commit for the 3.3 branch, after additional review.

[scribu]

Replying to nacin:

In [19640]:

Only allow _multisite_ super admins to demote themselves on a site. props linuxologos, see #19684 for trunk.

I was under the impression that "super admin" is exclusively a multisite feature.

[nacin]

Replying to scribu:

Replying to nacin:

In [19640]:

Only allow _multisite_ super admins to demote themselves on a site. props linuxologos, see #19684 for trunk.

I was under the impression that "super admin" is exclusively a multisite feature.

It is, but is_super_admin() returns true in single-site for administrators (it checks delete_users). We found this to be useful during the merge.

[ryan]

In [19646]:

Only allow _multisite_ super admins to demote themselves on a site. props linuxologos, fixes #19684 for 3.3