Prevent `do_not_allow` from being added as a capability

[peterwilsoncc]

In meta capabilities, WordPress uses the keyword do_not_allow to indicate a user should be blocked from performing a particular action (code ref).

WP_User, WP_Role and WP_Roles do not prevent a theme or plugin from adding do_not_allow as a capability. Adding this capability would cause unexpected behaviour so it should be blocked as a hardening measure.

[peterwilsoncc]

Will aim to put this in 4.9 soonish to let it soak.

@johnbillion,

I like the original patch but I am inclined to prevent do_not_allow from making it into the DB if WP is to block it, per 41059.2.patch​.

I'm in two minds as the original code is required to prevent the capability from being added via a filter. What are your thoughts?

[peterwilsoncc]

Will commit with @johnbillion's initial patch 41059.patch​, this is a backcompat break so will need a dev note.

[peterwilsoncc]

In 40993:

Capabilities: Prevent users having the do_not_allow capability.

Meta capabilities use the capability do_not_allow to indicate a user should be blocked from performing a particular action. This ensures users can not have the capability as it would cause unexpected behaviour.

Props johnbillion.
Fixes #41059.

[jbpaul17]

This is included in the ​https://make.wordpress.org/core/2017/10/15/improvements-for-roles-and-capabilities-in-4-9/ dev note. Thanks @flixos90!