diff --git a/src/wp-admin/user-edit.php b/src/wp-admin/user-edit.php index 6099904941..fbb1827e50 100644 --- a/src/wp-admin/user-edit.php +++ b/src/wp-admin/user-edit.php @@ -74,9 +74,26 @@ function use_ssl_preference($user) { ID && ! apply_filters( 'enable_edit_any_user_configuration', true ) ) +/** + * Filter whether to allow administrators on Multisite to edit every user. + * + * Enabling the user editing form via this filter also hinges on the user holding + * the 'manage_network_users' cap, and the logged-in user not matching the user + * profile open for editing. + * + * The filter was introduced to replace the EDIT_ANY_USER constant. + * + * @since 3.0.0 + * + * @param bool $allow Whether to allow editing of any user. Default true. + */ +if ( is_multisite() + && ! current_user_can( 'manage_network_users' ) + && $user_id != $current_user->ID + && ! apply_filters( 'enable_edit_any_user_configuration', true ) +) { wp_die( __( 'You do not have permission to edit this user.' ) ); +} // Execute confirmed email change. See send_confirmation_on_profile_email(). if ( is_multisite() && IS_PROFILE_PAGE && isset( $_GET[ 'newuseremail' ] ) && $current_user->ID ) { @@ -106,10 +123,27 @@ check_admin_referer('update-user_' . $user_id); if ( !current_user_can('edit_user', $user_id) ) wp_die(__('You do not have permission to edit this user.')); -if ( IS_PROFILE_PAGE ) - do_action('personal_options_update', $user_id); -else - do_action('edit_user_profile_update', $user_id); +if ( IS_PROFILE_PAGE ) { + /** + * Fires before the page loads on the 'Your Profile' editing screen. + * + * The action only fires if the current user is editing their own profile. + * + * @since 2.0.0 + * + * @param int $user_id The user ID. + */ + do_action( 'personal_options_update', $user_id ); +} else { + /** + * Fires before the page loads on the 'Edit User' screen. + * + * @since 2.7.0 + * + * @param int $user_id The user ID. + */ + do_action( 'edit_user_profile_update', $user_id ); +} if ( !is_multisite() ) { $errors = edit_user($user_id); @@ -188,8 +222,14 @@ if ( ! IS_PROFILE_PAGE ) { - -