From d5f61d9db3937e4bb8ee77049597ba1d9c841586 Mon Sep 17 00:00:00 2001
From: nacin <nacin@1a063a9b-81f0-0310-95a4-ce76da25c4cd>
Date: Tue, 27 Apr 2010 20:39:39 +0000
Subject: [PATCH] Explicitly set the capability required in edit_users
 map_meta_cap branch, so we don't accidentally pass edit_user. props
 TheDeadMedic. fixes #13074, fixes #13137

git-svn-id: http://svn.automattic.com/wordpress/trunk@14256 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/capabilities.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/wp-includes/capabilities.php b/wp-includes/capabilities.php
index 2bfa0b95d7..0a77f77775 100644
--- a/wp-includes/capabilities.php
+++ b/wp-includes/capabilities.php
@@ -782,8 +782,8 @@ class WP_User {
  *
  * This does not actually compare whether the user ID has the actual capability,
  * just what the capability or capabilities are. Meta capability list value can
- * be 'delete_user', 'edit_user', 'delete_post', 'delete_page', 'edit_post',
- * 'edit_page', 'read_post', or 'read_page'.
+ * be 'delete_user', 'edit_user', 'remove_user', 'promote_user', 'delete_post',
+ * 'delete_page', 'edit_post', 'edit_page', 'read_post', or 'read_page'.
  *
  * @since 2.0.0
  *
@@ -815,7 +815,7 @@ function map_meta_cap( $cap, $user_id ) {
 		if ( is_multisite() && !is_super_admin() )
 			$caps[] = 'do_not_allow';
 		else
-			$caps[] = $cap;
+			$caps[] = 'edit_users'; // Explicit due to primitive fall through
 		break;
 	case 'delete_post':
 		$author_data = get_userdata( $user_id );