Don't allow promoting a user that doesn't already belong to the blog.

git-svn-id: http://svn.automattic.com/wordpress/trunk@15150 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2010-06-06 15:05:18 +00:00 · 2010-06-06 15:05:18 +00:00 · 8d6108baa4
parent 977102dbb1
commit 8d6108baa4
1 changed files with 4 additions and 0 deletions
--- a/wp-admin/users.php
+++ b/wp-admin/users.php
@ -74,6 +74,10 @@ case 'promote':
 			continue;
 		}

+		// If the user doesn't already belong to the blog, bail.
+		if ( !is_user_member_of_blog( $id ) )
+			wp_die(__('Cheatin&#8217; uh?'));
+
 		$user = new WP_User($id);
 		$user->set_role($_REQUEST['new_role']);
 	}