diff --git a/wp-admin/includes/class-wp-users-list-table.php b/wp-admin/includes/class-wp-users-list-table.php index 21f6387133..bd9d8810ae 100644 --- a/wp-admin/includes/class-wp-users-list-table.php +++ b/wp-admin/includes/class-wp-users-list-table.php @@ -214,13 +214,12 @@ class WP_Users_List_Table extends WP_List_Table { * or below the table ("bottom"). */ protected function extra_tablenav( $which ) { - if ( 'top' != $which ) - return; + $id = 'bottom' === $which ? 'new_role2' : 'new_role'; ?>
- - @@ -250,8 +249,10 @@ class WP_Users_List_Table extends WP_List_Table { * @return string The bulk action required. */ public function current_action() { - if ( isset($_REQUEST['changeit']) && !empty($_REQUEST['new_role']) ) + if ( isset( $_REQUEST['changeit'] ) && + ( ! empty( $_REQUEST['new_role'] ) || ! empty( $_REQUEST['new_role2'] ) ) ) { return 'promote'; + } return parent::current_action(); } diff --git a/wp-admin/users.php b/wp-admin/users.php index 30e327a764..f452446461 100644 --- a/wp-admin/users.php +++ b/wp-admin/users.php @@ -95,8 +95,16 @@ case 'promote': } $editable_roles = get_editable_roles(); - if ( empty( $editable_roles[$_REQUEST['new_role']] ) ) - wp_die(__('You can’t give users that role.')); + $role = false; + if ( ! empty( $_REQUEST['new_role2'] ) ) { + $role = $_REQUEST['new_role2']; + } elseif ( ! empty( $_REQUEST['new_role'] ) ) { + $role = $_REQUEST['new_role']; + } + + if ( ! $role || empty( $editable_roles[ $role ] ) ) { + wp_die( __( 'You can’t give users that role.' ) ); + } $userids = $_REQUEST['users']; $update = 'promote'; @@ -106,7 +114,7 @@ case 'promote': if ( ! current_user_can('promote_user', $id) ) wp_die(__('You can’t edit that user.')); // The new role of the current user must also have the promote_users cap or be a multisite super admin - if ( $id == $current_user->ID && ! $wp_roles->role_objects[ $_REQUEST['new_role'] ]->has_cap('promote_users') + if ( $id == $current_user->ID && ! $wp_roles->role_objects[ $role ]->has_cap('promote_users') && ! ( is_multisite() && is_super_admin() ) ) { $update = 'err_admin_role'; continue; @@ -122,7 +130,7 @@ case 'promote': } $user = get_userdata( $id ); - $user->set_role($_REQUEST['new_role']); + $user->set_role( $role ); } wp_redirect(add_query_arg('update', $update, $redirect)); diff --git a/wp-includes/version.php b/wp-includes/version.php index 9c3002e98b..477b1ca0c2 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.4-alpha-34635'; +$wp_version = '4.4-alpha-34636'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.