WordPress.org
Get WordPress

Make WordPress Core

Changes between Initial Version and Version 2 of Ticket #31518


Ignore:
Timestamp:
09/05/2015 11:46:41 PM (10 years ago)
Author:
johnbillion
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #31518

    • Property Keywords dev-feedback added
    • Property Component changed from Users to Role/Capability

  • Ticket #31518 – Description

    initial v2  
     1{{{
     2add_filter('map_meta_cap', function(){return array();}, 1,0 ); //<-backdoor virus or any plugin
     3var_dump( user_can( $admin_user_id = 1, 'unavailable cap' ) ); //return true
     4var_dump( user_can( $Subscriber_user_id = 3, 'remove_users' ) ); //return true
     5}}}
    16
    2 {{{
    3         add_filter('map_meta_cap', function(){return array();}, 1,0 ); //<-backdor virus or any plugin
    4         var_dump( user_can( $admin_user_id = 1, 'unavailable cap' ) ); //return true
    5         var_dump( user_can( $Subscriber_user_id = 3, 'remove_users' ) ); //return true
    6        
    7          //The alternative I propose:
    8         // insert if(!in_array($cap,$caps)) return false; inside WP_User::has_cap( $cap ) after 'map_meta_cap' filter
    9         // OR
    10         // inside if(empty((array)$caps)) return false; inside WP_User::has_cap( $cap ) before the foreach
     7The alternative I propose:
     8insert `if(!in_array($cap,$caps)) return false;` inside `WP_User::has_cap( $cap )` after 'map_meta_cap' filter
     9OR
     10insert `if(empty((array)$caps)) return false;` inside `WP_User::has_cap( $cap )` before the foreach
    1111
    12 }}}
     12
    1313[https://core.trac.wordpress.org/browser/tags/4.1.1/src/wp-includes/capabilities.php#L965]
     14
    1415[https://www.diffchecker.com/9cjznf39]