Cannot disable 'Add existing user'

[bseddon]

The 'Add existing user' form on the Add New User page should only show if the user has been granted the 'promote_users' capability. At least I am inferring this is the intended purpose of the 'promote_users' capability because it's only used in wp-admin/users.php to restrict features relating to the addition of existing users.

However, it doesn't work because of the misplaced use of the variable $do_both.

$do_both is set to true if the installation is multi-site and the user has been granted both 'create_users' and 'promote_users' capabilities.

This variable is used incorrectly on line 307. Here it only prevents the display of the title of the form to add an existing user. I believe the variable $do_both should be added to the test on line 306 so the whole form, not just the heading, is displayed only when the user has been granted the 'promote_users' capability.

[swissspidy]

Introduced in [16294]

[Mista-Flo]

Fix wrong display of "Add existing user" form when user has user_promote cap

[Mista-Flo]

Here's a second patch. Thanks to @fperdaan for the review.

Since the conditional test of $do_both is already made line 13 with the is_multisite, and user cap test, it's not necessary to test again with $both var, we only need to test if it's multisite.

By the way the code of this file is really hard to read, a refactoring would be a nice thing to do to avoid DRY code.

[Mista-Flo]

Better fix

[flixos90]

I think the problem here is only related to the usage of the promote_users capability, not the $do_both variable. As @bseddon says on the ticket description, the "Add Existing User" form should only show when the user has the promote_users capability, but it currently shows regardless.

Of course the headings missing is weird, but it's not the actual bug, since when the additional capability check is added, the headings are displayed correctly under all circumstances.

[Mista-Flo]

Fix if state with promote user cap test

[Mista-Flo]

It should be good now.

[johnbillion]

In 41122:

Users: Don't show the 'Add Existing User' form on the 'Add New User' screen to users without the promote_users capability.

Props bseddon, Mista-Flo

Fixes #37836

[jeremyfelt]

#42249 was marked as a duplicate.