WordPress.org
Get WordPress

Make WordPress Core

Changeset 60977


Ignore:
Timestamp:
10/19/2025 05:40:13 PM (3 months ago)
Author:
johnjamesjacoby
Message:

Networks and Sites: remove email address check when attempting to demote a Super Admin.

This change ensures that a capable Super Admin is allowed to manage global Users as intended, and removes an invisible & undocumented restriction (that was easily bypassed anyways).

It also adds 1 multisite unit test to confirm the intended behavior

Props flixos90, johnjamesjacoby, Mista-Flo.

Fixes #39170.

Location:
trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/wp-admin/user-edit.php

    r60679 r60977  
    472472                    <?php endif; // End if ! IS_PROFILE_PAGE. ?>
    473473
    474                     <?php if ( is_multisite() && is_network_admin() && ! IS_PROFILE_PAGE && current_user_can( 'manage_network_options' ) && ! isset( $super_admins ) ) : ?>
     474                    <?php if ( is_multisite() && is_network_admin() && ! IS_PROFILE_PAGE && ! isset( $super_admins ) ) : ?>
    475475                        <tr class="user-super-admin-wrap">
    476476                            <th><?php _e( 'Super Admin' ); ?></th>
    477477                            <td>
    478                                 <?php if ( 0 !== strcasecmp( $profile_user->user_email, get_site_option( 'admin_email' ) ) || ! is_super_admin( $profile_user->ID ) ) : ?>
    479                                     <p><label><input type="checkbox" id="super_admin" name="super_admin"<?php checked( is_super_admin( $profile_user->ID ) ); ?> /> <?php _e( 'Grant this user super admin privileges for the Network.' ); ?></label></p>
    480                                 <?php else : ?>
    481                                     <p><?php _e( 'Super admin privileges cannot be removed because this user has the network admin email.' ); ?></p>
    482                                 <?php endif; ?>
     478                                <p><label><input type="checkbox" id="super_admin" name="super_admin"<?php checked( is_super_admin( $profile_user->ID ) ); ?> /> <?php _e( 'Grant this user super admin privileges for the Network.' ); ?></label></p>
    483479                            </td>
    484480                        </tr>

  • trunk/src/wp-includes/capabilities.php

    r60491 r60977  
    12531253 *
    12541254 * @since 3.0.0
     1255 * @since 6.9.0 Super admin privileges can be revoked regardless of email address.
    12551256 *
    12561257 * @global array $super_admins
    … …  
    12791280
    12801281    $user = get_userdata( $user_id );
    1281     if ( $user && 0 !== strcasecmp( $user->user_email, get_site_option( 'admin_email' ) ) ) {
     1282    if ( $user ) {
    12821283        $key = array_search( $user->user_login, $super_admins, true );
    12831284        if ( false !== $key ) {

  • trunk/tests/phpunit/tests/user/multisite.php

    r60915 r60977  
    449449        $wp_roles->remove_role( $role );
    450450    }
     451
     452    /**
     453     * @ticket 39170
     454     */
     455    public function test_revoke_super_admin_with_network_email() {
     456        if ( isset( $GLOBALS['super_admins'] ) ) {
     457            $old_global = $GLOBALS['super_admins'];
     458            unset( $GLOBALS['super_admins'] );
     459        }
     460
     461        $old_network_email = get_site_option( 'admin_email' );
     462        $email_address     = 'superadmin333@example.org';
     463
     464        $user_id = self::factory()->user->create(
     465            array(
     466                'user_email' => $email_address,
     467            )
     468        );
     469
     470        grant_super_admin( $user_id );
     471        update_site_option( 'admin_email', $email_address );
     472
     473        $result = revoke_super_admin( $user_id );
     474
     475        update_site_option( 'admin_email', $old_network_email );
     476
     477        if ( isset( $old_global ) ) {
     478            $GLOBALS['super_admins'] = $old_global;
     479        }
     480
     481        $this->assertTrue( $result );
     482    }
    451483}
Note: See TracChangeset for help on using the changeset viewer.