[wp-trac] [WordPress Trac] #16293: In multisite installs, users with id 1 or 2 can't be deleted

[WordPress Trac]

#16293: In multisite installs, users with id 1 or 2 can't be deleted
------------------------------------------------+-----------------------
 Reporter:  PeteMall                            |       Owner:
     Type:  defect (bug)                        |      Status:  reopened
 Priority:  normal                              |   Milestone:  3.9
Component:  Multisite                           |     Version:  3.1
 Severity:  normal                              |  Resolution:
 Keywords:  dev-feedback 3.7-early needs-patch  |
------------------------------------------------+-----------------------
Changes (by jeremyfelt):

 * keywords:  has-patch dev-feedback 3.7-early => dev-feedback 3.7-early
     needs-patch
 * milestone:  Future Release => 3.9


Comment:

 Looking at [attachment:16293.3.diff]:

 * We don't need to check `is_super_admin( $id )` as this is handled (with
 an error message) later in `confirm_delete_users()`
 * Less sure on the current user check. It depends on what a user with
 `manage_network_users` capabilities who is not a super admin is able to
 do.
 * Checking `admin_user_id` may make sense in that it should have already
 been updated to another ID through another process if the intent is to
 delete the original admin. This seems more appropriate than the
 `admin_email` check, but should be investigated some more.

 Most likely, if additional restrictions are added for the deletion of
 users, it should be inside `confirm_delete_users()` so that the messaging
 is easy to display as with other errors.

 I do think we can work to get this into the next cycle if we clarify a
 couple things here.

 Related: #20440

--
Ticket URL: <http://core.trac.wordpress.org/ticket/16293#comment:15>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software