editable_roles filter doesn't exclude role on multisite

[eArtboard]

On a multisite installation I am trying to exclude a role using editable_roles filter.

The role is removed from the dropdown but if I change the role value in the DOM using the inspector I can successfully add the excluded role.

This happens only on multisite installations. On single installations if I try to add an excluded role I get the message “Sorry, you are not allowed to give users that role.”

How to reproduce the issue:

1. Unset a role using editable_roles filter.
2. Login with any role that has the capability create_user.
3. Add a new user changing any role value with the excluded role (using inspector).

[thomaswm]

I think that line 159 in wp-admin/user-new.php is the culprit here. It passes $_REQUEST['role'] to wpmu_signup_user() without checking if the role is editable.

wpmu_signup_user( $new_user_login, $new_user_email, array( 'add_to_blog' => get_current_blog_id(), 'new_role' => $_REQUEST['role'] ) );

This adds a check to the create/add user to blog screen to match and allow only the roles that are displayed in the UI.

[peterwilsoncc]

I've added some notes to the linked pull request but agree this would be helpful to get in to WordPress 6.7.

I've set the version to 2.8 as that's when get_editable_roles() and the associated filter were introduced. It could be argued that it should be 3.0 as that's when Multisite was merged in to WordPress Core but let's not bikeshed it too much :)

[peterwilsoncc]

I've moved this off the milestone as there are some change requests on the PR that will need to be followed up prior to commit.

Trac ticket: https://core.trac.wordpress.org/ticket/43251
Existing PR: ​https://github.com/WordPress/wordpress-develop/pull/6808