[wp-trac] [WordPress Trac] #12109: map_meta_cap doesnt work for multisite superadmins

[WordPress Trac]

#12109: map_meta_cap doesnt work for multisite superadmins
------------------------------------+---------------------------------------
 Reporter:  dd32                    |        Owner:          
     Type:  defect (bug)            |       Status:  reopened
 Priority:  normal                  |    Milestone:  3.0     
Component:  Role/Capability         |      Version:          
 Severity:  normal                  |   Resolution:          
 Keywords:  multisite dev-feedback  |  
------------------------------------+---------------------------------------

Comment(by nacin):

 Whenever these functions are used in core, they need to be paired with
 proper capability checks, and they are.

 Here are various functions that do not have any capability checks:
 wp_delete_post(), wp_delete_user(), wp_revoke_user(), wp_insert_user(),
 not to mention the entire capabilities API.

 Not providing a full API is a huge problem, and it rears its head all too
 often. It happens in MU code all over the place. It stifles innovation and
 it prevents us from making changes in the future without breaking every
 plugin that had to go it alone previously.

 If we decide to change the storage schema, or offer an alternative such as
 #12815, anyone not using the API will have their code broken. In many
 cases, we are providing an API so we can detach plugins from the schema
 underneath, enabling it to evolve and be flexible.

 Any plugin can run update_site_option(), any plugin can modify the DB
 value, any plugin can attach hooks to the _site_option() API, and any
 plugin should be able to avoid all of those and use an abstracted API
 without penalty.

 It boils down to this: Plugins and themes can do anything. They're just
 going to avoid the API when we pretend they can't or when we attempt to
 restrict them.

 I am reverting [14011] and adding in transaction actions.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/12109#comment:14>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software