diff --git a/src/wp-admin/includes/ms.php b/src/wp-admin/includes/ms.php index 66fa2a060e..8c6aa48bba 100644 --- a/src/wp-admin/includes/ms.php +++ b/src/wp-admin/includes/ms.php @@ -190,6 +190,13 @@ function wpmu_delete_user( $id ) { if ( !$user->exists() ) return false; + + // Global super-administrators are protected, and cannot be deleted. + $_super_admins = get_super_admins(); + if ( in_array( $user->user_login, $_super_admins, true ) ) { + return false; + } + /** * Fires before a user is deleted from the network. * diff --git a/tests/phpunit/tests/user/multisite.php b/tests/phpunit/tests/user/multisite.php index 22a68358b2..41b0e88666 100644 --- a/tests/phpunit/tests/user/multisite.php +++ b/tests/phpunit/tests/user/multisite.php @@ -229,6 +229,58 @@ class Tests_Multisite_User extends WP_UnitTestCase { $this->assertQueryTrue( 'is_author', 'is_archive' ); } + function test_revoked_super_admin_can_be_deleted() { + if ( isset( $GLOBALS['super_admins'] ) ) { + $old_global = $GLOBALS['super_admins']; + unset( $GLOBALS['super_admins'] ); + } + + $user_id = $this->factory->user->create(); + grant_super_admin( $user_id ); + revoke_super_admin( $user_id ); + + $this->assertTrue( wpmu_delete_user( $user_id ) ); + + if ( isset( $old_global ) ) { + $GLOBALS['super_admins'] = $old_global; + } + } + + function test_revoked_super_admin_is_deleted() { + if ( isset( $GLOBALS['super_admins'] ) ) { + $old_global = $GLOBALS['super_admins']; + unset( $GLOBALS['super_admins'] ); + } + + $user_id = $this->factory->user->create(); + grant_super_admin( $user_id ); + revoke_super_admin( $user_id ); + wpmu_delete_user( $user_id ); + $user = new WP_User( $user_id ); + + $this->assertFalse( $user->exists(), 'WP_User->exists' ); + + if ( isset( $old_global ) ) { + $GLOBALS['super_admins'] = $old_global; + } + } + + function test_super_admin_cannot_be_deleted() { + if ( isset( $GLOBALS['super_admins'] ) ) { + $old_global = $GLOBALS['super_admins']; + unset( $GLOBALS['super_admins'] ); + } + + $user_id = $this->factory->user->create(); + grant_super_admin( $user_id ); + + $this->assertFalse( wpmu_delete_user( $user_id ) ); + + if ( isset( $old_global ) ) { + $GLOBALS['super_admins'] = $old_global; + } + } + /** * @ticket 27205 */