Changeset 5632

Timestamp:

07/08/2017 11:09:18 AM (8 years ago)

Author:

SergeyBiryukov

Message:

Support Forums: Disallow moderators and keymasters to edit admins and super admins, unless they have the same role.

See #1985.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-moderators.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-moderators.php

@@ -128 +128 @@
      * an Administrator role on the site.
      *
-     * @param array  $caps    User's actual capabilities.
-     * @param string $cap     Capability name.
-     * @param int    $user_id Current user ID.
-     * @param array  $args    Capability context, typically the object ID.
+     * @param array  $caps            User's actual capabilities.
+     * @param string $cap             Capability name.
+     * @param int    $current_user_id Current user ID.
+     * @param array  $args            Capability context, typically the object ID.
      * @return array Filtered capabilities.
      */
-    function map_meta_caps( $caps, $cap, $user_id, $args ) {
+    function map_meta_caps( $caps, $cap, $current_user_id, $args ) {
         switch ( $cap ) {
             case 'promote_user':
             case 'promote_users':
-                // Only keymasters can promote users.
-                $caps = array( 'keep_gate' );
-                break;
-
             case 'edit_user':
             case 'edit_users':
                 // Bail before "User Role" section is displayed.
                 // See https://bbpress.trac.wordpress.org/ticket/3126
-                if ( did_action( 'bbp_user_edit_after_account' ) && ! bbp_is_user_keymaster( $user_id ) ) {
+                if ( did_action( 'bbp_user_edit_after_account' ) && ! bbp_is_user_keymaster( $current_user_id ) ) {
                     return $caps;
                 }
 
                 // Get the user ID.
-                $_user_id = ! empty( $args[0] )
+                $user_id_to_check = ! empty( $args[0] )
                     ? (int) $args[0]
                     : bbp_get_displayed_user_id();
 
                 // Users can always edit themselves, so only map for others.
-                if ( ! empty( $_user_id ) && ( $_user_id !== $user_id ) ) {
-
+                if ( ! empty( $user_id_to_check ) && ( $user_id_to_check !== $current_user_id ) ) {
                     // Moderators cannot edit keymasters.
-                    if ( ! bbp_is_user_keymaster( $_user_id ) ) {
+                    if ( bbp_is_user_keymaster( $user_id_to_check ) ) {
+                        return $caps;
+                    }
+
+                    // Moderators and keymasters cannot edit admins or super admins, unless they have the same role.
+                    if ( user_can( $user_id_to_check, 'manage_options' ) || is_super_admin( $user_id_to_check ) ) {
+                        return $caps;
+                    }
+
+                    if ( 'promote_user' === $cap || 'promote_users' === $cap ) {
+                        // Only keymasters can promote users.
+                        $caps = array( 'keep_gate' );
+                    } else {
                         $caps = array( 'moderate' );
                     }