diff --git a/src/wp-admin/users.php b/src/wp-admin/users.php index 214c06d8d3..95d9f768bb 100644 --- a/src/wp-admin/users.php +++ b/src/wp-admin/users.php @@ -321,10 +321,6 @@ case 'doremove': $update = 'remove'; foreach ( $userids as $id ) { $id = (int) $id; - if ( $id == $current_user->ID && !is_super_admin() ) { - $update = 'err_admin_remove'; - continue; - } if ( !current_user_can('remove_user', $id) ) { $update = 'err_admin_remove'; continue; @@ -377,10 +373,7 @@ case 'remove': foreach ( $userids as $id ) { $id = (int) $id; $user = get_userdata( $id ); - if ( $id == $current_user->ID && !is_super_admin() ) { - /* translators: 1: user id, 2: user login */ - echo "
  • " . sprintf(__('ID #%1$s: %2$s The current user will not be removed.'), $id, $user->user_login) . "
  • \n"; - } elseif ( !current_user_can('remove_user', $id) ) { + if ( ! current_user_can( 'remove_user', $id ) ) { /* translators: 1: user id, 2: user login */ echo "
  • " . sprintf(__('ID #%1$s: %2$s Sorry, you are not allowed to remove this user.'), $id, $user->user_login) . "
  • \n"; } else { diff --git a/src/wp-includes/capabilities.php b/src/wp-includes/capabilities.php index 308c7063c8..78cde1c2ee 100644 --- a/src/wp-includes/capabilities.php +++ b/src/wp-includes/capabilities.php @@ -32,7 +32,12 @@ function map_meta_cap( $cap, $user_id ) { switch ( $cap ) { case 'remove_user': - $caps[] = 'remove_users'; + // In multisite the user must be a super admin to remove themselves. + if ( isset( $args[0] ) && $user_id == $args[0] && ! is_super_admin( $user_id ) ) { + $caps[] = 'do_not_allow'; + } else { + $caps[] = 'remove_users'; + } break; case 'promote_user': case 'add_users': diff --git a/tests/phpunit/tests/user/capabilities.php b/tests/phpunit/tests/user/capabilities.php index da1c313b88..d818ded9bf 100644 --- a/tests/phpunit/tests/user/capabilities.php +++ b/tests/phpunit/tests/user/capabilities.php @@ -1757,4 +1757,21 @@ class Tests_User_Capabilities extends WP_UnitTestCase { wp_set_current_user( self::$users['editor']->ID ); $this->assertFalse( current_user_can( 'add_user_meta', self::$users['subscriber']->ID, 'foo' ) ); } + + /** + * @ticket 39063 + */ + public function test_only_super_admins_can_remove_themselves_on_multisite() { + if ( ! is_multisite() ) { + $this->markTestSkipped( 'Test only runs in multisite.' ); + } + + $this->assertTrue( user_can( self::$super_admin->ID, 'remove_user', self::$super_admin->ID ) ); + + $this->assertFalse( user_can( self::$users['administrator']->ID, 'remove_user', self::$users['administrator']->ID ) ); + $this->assertFalse( user_can( self::$users['editor']->ID, 'remove_user', self::$users['editor']->ID ) ); + $this->assertFalse( user_can( self::$users['author']->ID, 'remove_user', self::$users['author']->ID ) ); + $this->assertFalse( user_can( self::$users['contributor']->ID, 'remove_user', self::$users['contributor']->ID ) ); + $this->assertFalse( user_can( self::$users['subscriber']->ID, 'remove_user', self::$users['subscriber']->ID ) ); + } }