Multisite: Capability check isn't strict enough when hard deleting a site

[henry.wright]

If the second argument passed to wpmu_delete_blog() is true, then a site can be hard deleted. By hard deleted I mean the site's database table will be dropped.

My understanding is, the delete_sites capability is granted to super administrators only. delete_sites will let the super administrator hard delete a site. Administrators don't have this capability. Instead, administrators have the delete_site capability.

In wp-admin/network/sites.php, wpmu_delete_blog() is called with true as the second argument. The capability check in this case is delete_site. Should this be delete_sites?

[henry.wright]

53694.diff fixes the capability check before hard deleting a site in the network.

[johnjamesjacoby]

Should this be delete_sites?

I think delete_site is OK.

See [31673] for the introduction of delete_site. It was manage_options previously, and it still maps to it currently.

My understanding is, the delete_sites capability is granted to super administrators only

Correct, grouped via map_meta_cap() with other super-admin caps such as create_sites and manage_sites.

Administrators don't have this capability. Instead, administrators have the delete_site capability.

Correct again – delete_site is also a meta capability, currently like:

case 'delete_site':
	if ( is_multisite() ) {
		$caps[] = 'manage_options';
	} else {
		$caps[] = 'do_not_allow';
	}
	break;

The capability check in this case is delete_site.

It is somewhat confusing that almost all delete_site cap checks pass in a blog ID (similar to other singular capabilities like delete_post) even though it is not used by WordPress internally, but then menu.php is forced to use it without one from [31673] – but it is nice to pass in for plugins to use.

(We could have the delete_site meta-cap default to get_current_blog_id(), but that would make it different from all of the other ID-based singular mapped caps that _doing_it_wrong() if no ID is passed.)

---

Let's close this as wontfix, and we can maybe open a new issue later for the delete_site inconsistencies.

[johnbillion]

Related:

• #39158
• #15801
• #17164