WordPress.org

Make WordPress Core

Opened 3 years ago

Closed 3 years ago

#39201 closed enhancement (fixed)

Replace current_user_can( 'manage_network_users' ) in wp-admin/includes/ajax-actions.php and wp-admin/user-new.php (line 228)

Reported by: ashokkumar24 Owned by: flixos90
Milestone: 4.8 Priority: normal
Severity: normal Version:
Component: Role/Capability Keywords: has-patch
Focuses: multisite Cc:
PR Number:

Description

This is part of the #37616 task. There are 2 is_super_admin() checks in wp-includes/option.php that should be replaced with current_user_can( 'manage_network' ).

Attachments (1)

39201.patch (1.2 KB) - added by ashokkumar24 3 years ago.
Replace current_user_can( 'manage_network_users' ) in wp-admin/includes/ajax-actions.php and wp-admin/user-new.php

Download all attachments as: .zip

Change History (6)

@ashokkumar24
3 years ago

Replace current_user_can( 'manage_network_users' ) in wp-admin/includes/ajax-actions.php and wp-admin/user-new.php

#1 in reply to: ↑ description @ashokkumar24
3 years ago

Replying to ashokkumar24:

This is part of the #37616 task. current_user_can( 'manage_network_users' ) in wp-admin/includes/ajax-actions.php and wp-admin/user-new.php.

#2 @flixos90
3 years ago

  • Keywords has-patch added
  • Milestone changed from Awaiting Review to 4.8
  • Owner set to flixos90
  • Status changed from new to assigned
  • Type changed from defect (bug) to enhancement

Hi @ashokkumar24, and thanks for the patch - looks good!

#3 follow-up: @johnbillion
3 years ago

The logic in src/wp-admin/user-new.php now includes two capability checks:

is_multisite() &&
current_user_can( 'promote_users' ) &&
! wp_is_large_network( 'users' ) &&
( current_user_can( 'manage_network_users' ) || apply_filters( 'autocomplete_users_for_site_admins', false ) )

Need to determine if both are actually needed here.

#4 in reply to: ↑ 3 @flixos90
3 years ago

Replying to johnbillion:

The logic in src/wp-admin/user-new.php now includes two capability checks:

is_multisite() &&
current_user_can( 'promote_users' ) &&
! wp_is_large_network( 'users' ) &&
( current_user_can( 'manage_network_users' ) || apply_filters( 'autocomplete_users_for_site_admins', false ) )

Need to determine if both are actually needed here.

I agree that it looks a bit uncommon to have two capability checks in one clause, but since the second is in a separate OR check, I think it should remain like that. This is also necessary to keep backward compatibility as the second capability check replaces is_super_admin() (or now rather detects whether the user has caps to manage network-wide users).

#5 @flixos90
3 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

In 39934:

Multisite: Replace is_super_admin() with manage_network_users when checking for users autocomplete capabilities.

Props ashokkumar24.
Fixes #39201. See #37616.

Note: See TracTickets for help on using tickets.