From c37f65296afee2e3cbf36591d684443e585c694d Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Tue, 23 Nov 2010 16:29:21 +0000
Subject: [PATCH] Make sure create_users is strippped from blog admins for
 multisite setups where add_new_users is not enabled. see #15357

git-svn-id: https://develop.svn.wordpress.org/trunk@16551 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-includes/capabilities.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/wp-includes/capabilities.php b/wp-includes/capabilities.php
index 0c95173e44..660ee50566 100644
--- a/wp-includes/capabilities.php
+++ b/wp-includes/capabilities.php
@@ -985,8 +985,12 @@ function map_meta_cap( $cap, $user_id ) {
 		}
 		break;
 	case 'create_users':
-		if ( !is_multisite() || is_super_admin() || get_site_option( 'add_new_users' ) )
+		if ( !is_multisite() )
 			$caps[] = $cap;
+		elseif ( is_super_admin() || get_site_option( 'add_new_users' ) )
+			$caps[] = $cap;
+		else
+			$caps[] = 'do_not_allow';
 		break;
 	default:
 		// Handle meta capabilities for custom post types.