Changeset 60976

Timestamp:

10/19/2025 05:18:55 PM (3 months ago)

Author:

johnjamesjacoby

Message:

Networks and Sites: prevent a PHP error in wp-admin/network/site-users.php.

This change brings the multisite specific promote user action up-to-speed with the single-site one, by adding:

• capability checks where appropriate
• a none check on $role to set it to an empty string

It also updates the inline documentation of the single-site promote user action in users.php, to match the suggested additions to the multisite file.

Props ignatiusjeroe, jeremyfelt, johnjamesjacoby, pratiklondhe, shanemuir, sudipatel007, techpartho.

Fixes #61100.

Location:

trunk/src/wp-admin

Files:

• network/site-users.php (modified) (3 diffs)
• users.php (modified) (2 diffs)

trunk/src/wp-admin/network/site-users.php

@@ -140 +140 @@
         case 'promote':
             check_admin_referer( 'bulk-users' );
+
+            if ( ! current_user_can( 'promote_users' ) ) {
+                wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 );
+            }
+
             $editable_roles = get_editable_roles();
             $role           = $_REQUEST['new_role'];
 
+            // Mock `none` as editable role.
+            $editable_roles['none'] = array(
+                'name' => __( '— No role for this site —' ),
+            );
+
             if ( empty( $editable_roles[ $role ] ) ) {
                 wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );
+            }
+
+            if ( 'none' === $role ) {
+                $role = '';
             }
 
@@ -152 +166 @@
                 foreach ( $userids as $user_id ) {
                     $user_id = (int) $user_id;
+
+                    if ( ! current_user_can( 'promote_user', $user_id ) ) {
+                        wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 );
+                    }
 
                     // If the user doesn't already belong to the blog, bail.
@@ -163 +181 @@
 
                     $user = get_userdata( $user_id );
+
+                    // If $role is empty, none will be set.
                     $user->set_role( $role );
                 }

trunk/src/wp-admin/users.php

@@ -123 +123 @@
         $role           = $_REQUEST['new_role'];
 
-        // Mocking the `none` role so we are able to save it to the database
+        // Mock `none` as editable role.
         $editable_roles['none'] = array(
             'name' => __( '— No role for this site —' ),
@@ -163 +163 @@
 
             $user = get_userdata( $id );
+
+            // If $role is empty, none will be set.
             $user->set_role( $role );
         }