Changeset 3714309

Timestamp:

09/26/2026 01:53:30 PM (4 weeks ago)

Author:

nanosani

Message:

User roles issues fixed.

Location:

itx-userops/trunk

Files:

• itx-userops.php (modified) (2 diffs)
• readme.txt (modified) (3 diffs)
• src/Modules/Roles/Writer.php (modified) (2 diffs)

itx-userops/trunk/itx-userops.php

@@ -4 +4 @@
  * Plugin URI:        https://itxuserops.com
  * Description:       User management, login activity, sessions & audit log — one unified admin console for WordPress users.
- * Version:           2.2.1
+ * Version:           2.2.2
  * Requires at least: 6.6
  * Requires PHP:      7.4
@@ -19 +19 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'ITXUO_VERSION', '2.2.1' );
+define( 'ITXUO_VERSION', '2.2.2' );
 define( 'ITXUO_PATH', plugin_dir_path( __FILE__ ) );
 define( 'ITXUO_URL', plugin_dir_url( __FILE__ ) );

itx-userops/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 2.2.1
+Stable tag: 2.2.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -218 +218 @@
 
 == Changelog ==
+
+= 2.2.2 =
+* Fixed: "Duplicate Administrator" was refused with "You cannot grant access you do not have yourself" on most sites. WordPress switches some of the administrator's capabilities off at run time (file editing when DISALLOW_FILE_EDIT is set, the Links manager, unfiltered uploads), and WooCommerce stores per-item ones, and the role editor read all of those as not held. Capabilities your own role grants can now be copied. No other change.
 
 = 2.2.1 =
@@ -271 +274 @@
 == Upgrade Notice ==
 
+= 2.2.2 =
+Fixes "Duplicate Administrator" in the role editor, which was refused on most sites.
+
 = 2.2.1 =
 Fixes 2.2.0, which was published without two of its files and stopped sites loading. Update now.

itx-userops/trunk/src/Modules/Roles/Writer.php

@@ -162 +162 @@
          * and it already accounts for the network boundary.
          *
+         * "Hold" includes what the user's own roles grant ON PAPER, and that is what
+         * made "Duplicate Administrator" work again (2.2.2). WordPress switches some
+         * capabilities off for everyone at run time — edit_plugins, edit_themes and
+         * edit_files under DISALLOW_FILE_EDIT, manage_links when the Links manager
+         * is off, unfiltered_upload unless ALLOW_UNFILTERED_UPLOADS — and WooCommerce
+         * stores per-item capabilities (edit_product, read_shop_order) that
+         * current_user_can() can only answer for a specific item. The administrator
+         * role holds all of them, current_user_can() said no to all of them, and the
+         * ceiling refused to copy the role it was looking at. Granting what your own
+         * role already grants cannot lift anyone above you: the same run-time switch
+         * applies to whoever receives it.
+         *
          * @param string[] $adding Capabilities about to be granted.
          * @return true|\WP_Error
@@ -172 +184 @@
                 $refused = array();
 
+                $user = wp_get_current_user();
+
                 foreach ( $adding as $cap ) {
-                        if ( ! current_user_can( $cap ) ) {
+                        // On paper first: it answers without asking WordPress to map a
+                        // per-item capability with no item, which it reports as an error.
+                        $on_paper = $user instanceof \WP_User && $user->exists() && ! empty( $user->allcaps[ (string) $cap ] );
+
+                        if ( ! $on_paper && ! current_user_can( $cap ) ) {
                                 $refused[] = $cap;
                         }