Replace `is_super_admin()` calls with real capability checks

[flixos90]

As discussed in Multisite office hours (​https://wordpress.slack.com/archives/core-multisite/p1470762377000454), there are plans to improve capability handling in WordPress, to also support network-wide (and possibly global) capabilities. The current is_super_admin() check system is no actual role- and capability-based system which makes it impractical to refine roles and capabilities on this level.

While a super admin should have access to all capabilities, we should get rid of all is_super_admin() checks that happen outside of WP_User and the map_meta_cap() function and replace those calls with dedicated capabilities. There might be a few other occurrences where is_super_admin() is actually the right choice, but generally it shouldn't be used in other locations anymore. This will open up new possibilities to think about how we can implement a true role- and capability-based system beyond the scope of a site.

The hardest part of this ticket will probably be finding names for the new capabilities. The good thing is that we most likely won't need to touch any roles or adjust map_meta_cap() since the new capabilities should only be granted to the super admin for now anyway.

We should probably create a list of occurrences and think about names for the capabilities (or whether we can use existing capabilities) first.

[Presskopp]

We should probably create a list of occurrences

At your service:

Search "is_super_admin()" (32 hits in 18 files)
  
...\wp-admin\edit-form-advanced.php (1 hit)
	Line 311: 	if ( is_super_admin() || current_user_can( $post_type_object->cap->edit_others_posts ) )
  
...\wp-admin\includes\ajax-actions.php (1 hit)
	Line 251: 	if ( ! is_super_admin() && ! apply_filters( 'autocomplete_users_for_site_admins', false ) )
  
...\wp-admin\includes\class-wp-posts-list-table.php (1 hit)
	Line 1407: 			if ( is_super_admin() || current_user_can( $post_type_object->cap->edit_others_posts ) ) :
  
...\wp-admin\includes\ms.php (2 hits)
	Line 690: 	if ( !is_super_admin() )
	Line 759: 	if ( ! is_super_admin() ) {
  
...\wp-admin\menu.php (1 hit)
	Line 31: if ( ! is_multisite() || is_super_admin() )
  
...\wp-admin\network.php (1 hit)
	Line 18: if ( ! is_super_admin() ) {
  
...\wp-admin\options-general.php (2 hits)
	Line 344: 				'show_available_translations' => ( ! is_multisite() || is_super_admin() ) && wp_can_install_language_pack(),
	Line 349: 				if ( is_super_admin() ) {
  
...\wp-admin\options.php (3 hits)
	Line 77: if ( is_multisite() && ! is_super_admin() && 'update' != $action ) {
	Line 163: 		if ( is_multisite() && ! is_super_admin() )
	Line 184: 		if ( ! empty( $_POST['WPLANG'] ) && ( ! is_multisite() || is_super_admin() ) ) { // @todo: Skip if already installed
  
...\wp-admin\user-new.php (3 hits)
	Line 40: 		if ( is_super_admin() ) {
	Line 221: 	&& ( is_super_admin() || apply_filters( 'autocomplete_users_for_site_admins', false ) )
	Line 309: 	if ( !is_super_admin() ) {
  
...\wp-admin\users.php (3 hits)
	Line 125: 			&& ! ( is_multisite() && is_super_admin() ) ) {
	Line 324: 		if ( $id == $current_user->ID && !is_super_admin() ) {
	Line 380: 		if ( $id == $current_user->ID && !is_super_admin() ) {

	
...\wp-includes\admin-bar.php (4 hits)
	Line 286: 	if ( ! is_user_member_of_blog() && ! is_super_admin() )
	Line 383: 	if ( count( $wp_admin_bar->user->blogs ) < 1 && ! is_super_admin() )
	Line 398: 	if ( is_super_admin() ) {
	Line 454: 			'class' => is_super_admin() ? 'ab-sub-secondary' : '',
  
...\wp-includes\capabilities.php (1 hit)
	Line 366: 			// update_, install_, and delete_ are handled above with is_super_admin().
  
...\wp-includes\link-template.php (1 hit)
	Line 3479: 	if ( ! is_super_admin() && empty($blogs) ) {
  
...\wp-includes\ms-deprecated.php (3 hits)
	Line 58:  * @deprecated 3.0.0 Use is_super_admin()
	Line 59:  * @see is_super_admin()
	Line 64: 	_deprecated_function( __FUNCTION__, '3.0.0', 'is_super_admin()' );
  
...\wp-includes\ms-functions.php (1 hit)
	Line 579: 	if ( strlen( $blogname ) < 4 && !is_super_admin() )
  
...\wp-includes\ms-load.php (1 hit)
	Line 84: 	if ( is_super_admin() )
  
...\wp-includes\option.php (2 hits)
	Line 797: 	if ( is_super_admin() && ! is_user_member_of_blog() ) {
	Line 961: 	if ( is_super_admin() && ! is_user_member_of_blog() ) {

	
...\wp-signup.php (1 hit)
	Line 825: if ( is_super_admin() ) {

[jeremyfelt]

Replying to flixos90:

While a super admin should have access to all capabilities, we should get rid of all is_super_admin() checks that happen outside of WP_User and the map_meta_cap() function

I think this is the perfect way to phrase it. :)

The hardest part of this ticket will probably be finding names for the new capabilities. The good thing is that we most likely won't need to touch any roles or adjust map_meta_cap() since the new capabilities should only be granted to the super admin for now anyway.

We'll probably figure out a strategy as we get started, but my first guess is that we'd want to create new tickets for each new capability introduced and then use that ticket to decide on the name and make all of the related replacements.

Thanks for the list @Presskopp!

[flixos90]

I'll look over all the occurrences and prepare some thoughts over these by some time next week.

[flixos90]

I looked through all occurrences of is_super_admin() as listed above (ignoring those that are inside map_meta_cap() as we likely cannot get around these until we have dedicated network role management).

I identified three general types of changes we need to do. The following is a list of the is_super_admin() occurrences and my suggestions how to handle them.

---

Get rid of checks:

• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/edit-form-advanced.php#L311 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/class-wp-posts-list-table.php#L1407
  • remove check, other cap should be sufficient
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/menu.php#L31
  • remove check, the data isn't used anywhere under that condition (not sure why that check is there)
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/users.php#L324 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/users.php#L380
  • could be handled in map_meta_cap() instead (see check below respectively)

Use existing capabilities:

• https://core.trac.wordpress.org/browser/trunk/src/wp-includes/admin-bar.php#L287 and https://core.trac.wordpress.org/browser/trunk/src/wp-includes/admin-bar.php#L386 and https://core.trac.wordpress.org/browser/trunk/src/wp-includes/admin-bar.php#L401 and https://core.trac.wordpress.org/browser/trunk/src/wp-includes/admin-bar.php#L457 and https://core.trac.wordpress.org/browser/trunk/src/wp-includes/link-template.php#L3473 and https://core.trac.wordpress.org/browser/trunk/src/wp-includes/link-template.php#L3479 and https://core.trac.wordpress.org/browser/trunk/src/wp-includes/option.php#L797 and https://core.trac.wordpress.org/browser/trunk/src/wp-includes/option.php#L961 and https://core.trac.wordpress.org/browser/trunk/src/wp-signup.php#L825
  • use capability manage_network
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/options.php#L77 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/options.php#L163
  • use manage_network_options
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/ajax-actions.php#L249 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/user-new.php#L40 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/user-new.php#L221 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/user-new.php#L309 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/users.php#L125
  • adjust capability promote_users

Introduce new capabilities:

• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/ms.php#L690
  • introduce capability import_users
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/ms.php#L759
  • introduce capability upgrade_network
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/network.php#L18
  • introduce capability setup_multisite and add it to administrator role (it would make sense to change the related menu item to use that capability as well)
• https://core.trac.wordpress.org/browser/trunk/src/wp-includes/ms-functions.php#L579
  • introduce capability unfiltered_sites
• https://core.trac.wordpress.org/browser/trunk/src/wp-includes/ms-load.php#L84
  • introduce capability see_blocked_sites
• https://core.trac.wordpress.org/browser/trunk/src/wp-admin/options-general.php#L344 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/options-general.php#L349 and https://core.trac.wordpress.org/browser/trunk/src/wp-admin/options.php#L184
  • introduce capability install_languages

---

A note on the above: There are several capabilities that are available to admins on a regular setup, but only to a super admin on multisite:

• out of the above capabilities, we would need to change promote_users to become such a capability (add do_not_allow via map_meta_cap() if on multisite and user is not a super admin)
• out of the above capabilities, the new capabilities install_languages and maybe import_users would need to be added to the administrator role, but then be handled in map_meta_cap() as well (do_not_allow if on multisite and user is not a super admin)
• the new capability setup_multisite needs to be added to the administrator role
• the other new capabilities only apply to super admins so they wouldn't need to be added to any role for now

About the next steps: The above occurrences add up to 12 groups in total (some of these occurrences are certainly directly related, therefore less groups then occurrences). I think we should start opening 12 individual tickets for these for further discussion after we have some initial feedback (in this ticket).

[johnbillion]

If any new capabilities are introduced, they should be added to the final block of case statements in map_meta_cap() so they can be unit tested in Tests_User_Capabilities.

[jeremyfelt]

Moving this to future release. We'll be focusing on this for 4.8. I assigned the early tag so that we know to assign it to the 4.8 milestone immediately. Some tickets associated with this will go in early, others don't have to.

[jeremyfelt]

Bumping to the 4.8 cycle as it's something we want to start focusing on now. We'll be having a discussion in #core-multisite on Nov 22 at 17:00 UTC to walk through this and start making some decisions.

[flixos90]

In today's multisite office hours we started reviewing the proposed changes from above. The goal is to decide the right approach for each occurrence of is_super_admin() and then determine how these changes should be handled in terms of additional tickets.

This comment serves as a summary for today's progress. It will describe every ticket we agreed on so far.

• Ticket 1: remove 2 checks in wp-admin/edit-form-advanced.php and wp-admin/includes/class-wp-posts-list-table.php
• Ticket 2: replace 1 check with current_user_can( 'update_core' ) in wp-admin/menu.php
• Ticket 3: move the logic to prevent non-super admins/network administrators from removing themselves into map_meta_cap() and then remove the 2 additional clauses (including the one more specific error message) in wp-admin/users.php
• Ticket 4: replace 4 checks with current_user_can( 'manage_network' ) in wp-includes/admin-bar.php
• Ticket 5: replace 2 checks with user_can( $user_id, 'manage_network' ) in wp-includes/link-template.php (make sure to pass the $user_id to both calls, it looks like a bug currently); also add unit tests for get_dashboard_url(); in addition the clause in https://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/class-wp-users-list-table.php#L413 can also be simplified after that change

We will continue reviewing that list (starting with the occurrences in wp-includes/option.php) tomorrow (Wednesday) at 17:00 UTC in ​https://wordpress.slack.com/messages/core-multisite. Please make sure to join if you're available and interested in helping out.

[flixos90]

Results from today's meeting (continues the above comment):

• Ticket 6: replace 2 checks with current_user_can( 'manage_network' ) in wp-includes/option.php
• Ticket 7: replace 1 check with current_user_can( 'manage_network' ) in wp-signup.php; in addition, change the message string to Greetings Network Administrator! The network currently allows &#8220;%s&#8221; registrations. To change or disable registration go to your <a href="%s">Options page</a>. and the $i18n['blog'] string to site to match current naming conventions
• Ticket 8: replace 2 checks with current_user_can( 'manage_network_options' ) in wp-admin/options.php (lines 77 and 163)
• Ticket 9: replace 2 checks with current_user_can( 'manage_network_users' ) in wp-admin/includes/ajax-actions.php and wp-admin/user-new.php (line 228)
• Ticket 10: replace 2 checks with current_user_can( 'manage_network_users' ) in wp-admin/user-new.php (lines 40 and 316)
• Ticket 11: remove 1 check in wp-admin/user-new.php (line 66): it's not necessary and might even be considered a bug (right now, when adding a network administrator who's already on the site, that user is still invited again which makes no sense); the $username != null check might be removed as well, but that should be discussed on another ticket

The review will continue (starting with the occurrence in wp-admin/users.php) during the next multisite office hours (Tuesday 17:00 UTC).

[flixos90]

Results from today's meeting (completes the above two comments):

• Ticket 12: replace 1 check with current_user_can( 'manage_network_users' ) in wp-admin/users.php
• Ticket 13: replace 1 check with current_user_can( 'manage_network_users' ) in wp-admin/includes/ms.php (line 707)
• Ticket 14: replace 1 check with current_user_can( 'upgrade_database' ) in wp-admin/includes/ms.php (line 776); this is a completely new capability, thus it needs to be documented (needs-dev-note) and added to the capability unit tests
• Ticket 15: replace 1 check with current_user_can( 'manage_options' ) in wp-admin/network.php
• Ticket 16: remove the entire clause in wp-includes/ms-functions.php line 579; the filter wpmu_validate_blog_signup should be used if this functionality is needed; this change is backward-incompatible and therefore needs to be documented (needs-dev-note)
• Ticket 17: open a new ticket to implement dedicate site (and maybe network capabilities, such as current_user_can( 'manage_site', $site_id ) or current_user_can( 'manage_network', $network_id ); after having figured this out, replace 1 check with current_user_can( 'manage_site', $blog->id ) in wp-includes/ms-load.php (line 84) and move it below the get_site() call
• Ticket 18: replace 1 check with current_user_can( 'manage_options' ) in wp-admin/options-general.php (line 349)
• Ticket 19: discuss the future of how translation installs should be handled, in tickets #38664 and #38673; then the checks in wp-admin/options-general.php (line 344) and wp-admin/options.php (line 184) can either be completely removed or be replaced with a capability as a result of that discussion

That's it for reviewing this ticket. We have 19 tickets to handle in total several of which are very straightforward now. Let's start working on these over the next couple of weeks. Only tickets 17 and 19 rely on other discussions to happen first, so we can tackle the others immediately. When opening a ticket, please reference it in this thread as well.

[flixos90]

The first 5 tickets have been opened in #39059, #39060, #39063, #39064 and #39065.

[flixos90]

In 39492:

Multisite: Replace is_super_admin() with manage_network for admin bar permissions.

Props iaaxpage.
Fixes #39064. See #37616.

[flixos90]

In 39539:

Multisite: Remove redundant is_super_admin() when checking for edit_others_posts.

The super admin on multisite as well as the administrator on non-multisite both have this capability already. For custom post types using different capabilities this change ensures that only users with that capability have permissions.

Fixes #39059. See #37616.

[flixos90]

In 39540:

Multisite: Replace is_super_admin() with update_core for update permissions.

Fixes #39060. See #37616.

[sathyapulse]

Hi @flixos90

Created ticket and patch for Ticket 8: #39200.

Please check.

[chandrapatel]

Hi @flixos90

I have create Ticket 6: #39199 and also applied patch.

Please check and let me know if its fine.

[ashokkumar24]

Hi @flixos90,

Created ticket and patch for Ticket 9: #39201.

Please check and let me know.

[dhanendran]

Hi @flixos90 ,

I have created ticket and patch for task 10: #39202 and task 14: #39205

Please have a look and let me know if it is works.

[ashokkumar24]

#39203 was marked as a duplicate.

[abhishek kaushik]

Yo @flixos90 ,
created ticket and patch for 12 : #39204

[Dhaval Parekh]

Hi @flixos90
I have create Ticket 18: #39207 and also applied patch.

[jignesh.nakrani]

Hi @flixos90
I have created Ticket 7: #39209 and also attached the patch.

[flixos90]

To summarize:

• Ticket 6: #39199
• Ticket 7: #39209
• Ticket 8: #39200
• Ticket 9: #39201
• Ticket 10: #39202
• Ticket 11: #39220
• Ticket 12: #39204
• Ticket 13: #39212
• Ticket 14: #39205
• Ticket 15: #39206
• Ticket 16: #39676
• Ticket 18: #39207

Thanks a lot to @Dhaval Parekh @abhishek kaushik @dhanendran @chandrapatel @ashokkumar24 @sathyapulse @jignesh.nakrani - feel free to open the other ones as well (except 17 and 19 since they need something else to happen first)! :)

[bhargavbhandari90]

Hi @flixos90

I have create Ticket 13.
Here is the link: https://core.trac.wordpress.org/ticket/39212
And also attached the patch.

[supercoder]

Hi @flixos90
I have create Ticket 11.
Here is the link: https://core.trac.wordpress.org/ticket/39220
And also attached the patch. Please check.

[flixos90]

In 39588:

Multisite: Handle capability check for removing oneself via map_meta_cap().

Site administrators should not be able to remove themselves from a site. This moves the enforcement of this rule from wp-admin/users.php to remove_user_from_blog() via the remove_user capability, which furthermore allows us to get rid of two additional clauses and their is_super_admin() checks in wp-admin/users.php. A unit test for the new behavior has been added.

Fixes #39063. See #37616.

[flixos90]

In 39589:

Multisite: Replace is_super_admin() with manage_network in get_dashboard_url().

Unit tests for get_dashboard_url() have been added.

Props iaaxpage.
Fixes #39065. See #37616.

[flixos90]

In 39932:

Multisite: Do not check for is_super_admin() when trying to set user settings.

The checks were introduced in [22256] to prevent user settings to be set for super admins that were not a member of the current site. However the latter should apply to any kind of user, so the is_super_admin() check is redundant. Furthermore, removing these checks is necessary for the ongoing effort to get rid of is_super_admin() checks in general.

Props chandrapatel for initial patch.
Fixes #39199. See #37616.

[flixos90]

In 39933:

Multisite: Replace is_super_admin() with manage_network_options in wp-admin/options.php.

Props sathyapulse.
Fixes #39200. See #37616.

[flixos90]

In 39934:

Multisite: Replace is_super_admin() with manage_network_users when checking for users autocomplete capabilities.

Props ashokkumar24.
Fixes #39201. See #37616.

[flixos90]

In 39935:

Multisite: Replace is_super_admin() with manage_network_users when trying to add an existing user via username.

Props dhanendran.
Fixes #39202. See #37616.

[flixos90]

In 39943:

Multisite: Replace is_super_admin() with manage_network_users when trying to change the role of oneself.

Props abhishek kaushik.
Fixes #39204. See #37616.

[flixos90]

In 39944:

Multisite: Replace is_super_admin() with manage_network when showing a message to the network administrator in wp-signup.php.

Props jignesh.nakrani.
Fixes #39209. See #37616.

[flixos90]

In 39945:

Multisite: Replace is_super_admin() with manage_network_users when trying to import new users.

Props bhargavbhandari90.
Fixes #39212. See #37616.

[flixos90]

In 39946:

Multisite: Remove unnecessary is_super_admin() check when adding an existing user to a site.

Prior to this change, a super admin user that is added to a site who they are already a member of would still get reinvited.

Props supercoder.
Fixes #39220. See #37616.

[flixos90]

In 39947:

Multisite: Replace is_super_admin() with a proper capability check when showing a notice about WPLANG.

In multisite, the notice is displayed to users that have the manage_network_options capability. In non-multisite, the notice is displayed to users with the manage_options capability.

Props Dhaval Parekh.
Fixes #39207. See #37616.

[flixos90]

Latest update:

• There appears to be nothing in the way of ticket 14 (#39205), 15 (#39206) and 16 (#39676). These will probably be committed soon.
• Before opening a ticket for 17, #39156 must be finished.
• Before opening a ticket for 19, #39677 must be finished. #38673 is also related here.

[flixos90]

In 40295:

Multisite: Remove restriction of minimum site name length in wpmu_validate_blog_signup().

It is sometimes desirable to support shorter site names than 4 characters, therefore that restriction should be removed. It is still possible to manually enforce it by using the wpmu_validate_blog_signup filter.

As a result of this change, another is_super_admin() call gets removed which affects the ongoing efforts of working on a network-wide role system.

Props milindmore22.
Fixes #39676. See #37616.

[flixos90]

In 40390:

Multisite: Introduce a setup_network capability for setting up multisite.

setup_network is a new meta capability that brings more granular control over the permissions to setup a multisite environment. In a non-multisite environment it falls back to manage_options while in a multisite it falls back to manage_network_options. The introduction of this capability furthermore allows replacing an is_super_admin() check.

Props ashokkumar24 for the original patch.
Fixes #39206. See #37616.

[flixos90]

In 40391:

Multisite: Partially revert [40295].

[40295] removed the restriction of a minimum amount of characters for new site names, which could cause unexpected behavior. That changeset is reverted here with the exception of the removal of the is_super_admin() check, which can safely be omitted. A new filter for the minimum site name length will be introduced later to be able to modify that behavior.

See #39676, #37616.

[flixos90]

Just an update on the current state:

Out of the original list, #39205 is almost done; #39676 is still open for other reasons, but the is_super_admin() check has already been removed.

Still to-do:

• Replace check in wp-includes/ms-load.php (line 84) with current_user_can( 'manage_site', $blog->id ) and move it below the get_site() call. This relies on #39156 to be completed prior.
• Replace the checks in wp-admin/options-general.php (line 147) and wp-admin/options.php (line 185) with capabilities for managing translations. This relies on #39677 to be completed prior.

Unfortunately I found further occurrences of is_super_admin() that we missed before (apparently we didn't look for occurrences of is_super_admin( $user_id )). Individual tickets will need to be opened for those as well, but I'll list them here including suggestions on how to get rid of them:

• Remove check in wp-admin/includes/schema.php (line 957) and instead only query users with the 'administrator' role in the above query. This usage only occurs on non-multisite, so it is essentially the same as looking for site administrators.
• Replace the following checks with user_can( $user_id, 'manage_network' ) (these are general checks whether a user is a super admin and therefore we should use the most basic capability to determine that, which is manage_network):
  • wp-admin/includes/class-wp-ms-users-list-table.php (line 208)
  • wp-admin/upgrade.php (lines 265 and 281)
  • wp-admin/network/site-new.php (line 132)
  • wp-admin/network/users.php (line 69)
  • wp-admin/user-edit.php (line 157)
  • wp-includes/ms-functions.php (line 1188)
  • wp-login.php (line 835)

[flixos90]

In 40404:

Multisite: Introduce an upgrade_network capability.

Prior to this change, a mix of is_super_admin() calls and manage_network capability checks was used to determine whether the current user could upgrade the network. With this changeset a dedicated capability is introduced that allows more granular handling.

Props dhanendran for the original patch.
Fixes #39205. See #37616.

[flixos90]

In 40406:

Multisite: Replace unnecessary is_super_admin() check when setting up the initial network.

When using is_super_admin() in a non-multisite environment, the function is supposed to check for administrator capabilities. The process of querying all users and filtering them with that function can be optimized by only querying users with the administrator role instead.

Fixes #40406. See #37616.

[flixos90]

To-Do:

• Replace check in wp-includes/ms-load.php (line 84) with current_user_can( 'manage_site', $blog->id ) and move it below the get_site() call. This relies on #39156 to be completed prior.
• Replace the checks in wp-admin/options-general.php (line 147) and wp-admin/options.php (line 185) with capabilities for managing translations. This relies on #39677 to be completed prior.
• Replace the following checks with user_can( $user_id, 'manage_network' ) (these are general checks whether a user is a super admin and therefore we should use the most basic capability to determine that, which is manage_network):
  • wp-admin/includes/class-wp-ms-users-list-table.php (line 208)
  • wp-admin/upgrade.php (lines 265 and 281)
  • wp-admin/network/site-new.php (line 132)
  • wp-admin/network/users.php (line 69)
  • wp-admin/user-edit.php (line 157)
  • wp-includes/ms-functions.php (line 1188)
  • wp-login.php (line 835)

No tickets have been opened yet for any of the above three items.

[flixos90]

Since this ticket is waiting on the two other ones, let's come back once their work is completed. The other functions can be adjusted on-the-go.