<?php

[0] Fix | Delete

[1] Fix | Delete

namespace WordfenceLS;

[2] Fix | Delete

[3] Fix | Delete

class Controller_Permissions {

[4] Fix | Delete

const CAP_ACTIVATE_2FA_SELF = 'wf2fa_activate_2fa_self'; //Activate 2FA on its own user account

[5] Fix | Delete

const CAP_ACTIVATE_2FA_OTHERS = 'wf2fa_activate_2fa_others'; //Activate 2FA on user accounts other than its own

[6] Fix | Delete

const CAP_MANAGE_SETTINGS = 'wf2fa_manage_settings'; //Edit settings for the plugin

[7] Fix | Delete

[8] Fix | Delete

const SETTING_LAST_ROLE_CHANGE = 'wfls_last_role_change';

[9] Fix | Delete

const SETTING_LAST_ROLE_SYNC = 'wfls_last_role_sync';

[10] Fix | Delete

[11] Fix | Delete

private $network_roles = array();

[12] Fix | Delete

private $multisite_roles = null;

[13] Fix | Delete

[14] Fix | Delete

/**

[15] Fix | Delete

* Returns the singleton Controller_Permissions.

[16] Fix | Delete

*

[17] Fix | Delete

* @return Controller_Permissions

[18] Fix | Delete

*/

[19] Fix | Delete

public static function shared() {

[20] Fix | Delete

static $_shared = null;

[21] Fix | Delete

if ($_shared === null) {

[22] Fix | Delete

$_shared = new Controller_Permissions();

[23] Fix | Delete

}

[24] Fix | Delete

return $_shared;

[25] Fix | Delete

}

[26] Fix | Delete

[27] Fix | Delete

public function install() {

[28] Fix | Delete

$this->_on_role_change();

[29] Fix | Delete

if (is_multisite()) {

[30] Fix | Delete

//Super Admin automatically gets all capabilities, so we don't need to explicitly add them

[31] Fix | Delete

$this->_add_cap_multisite('administrator', self::CAP_ACTIVATE_2FA_SELF, $this->get_primary_sites());

[32] Fix | Delete

}

[33] Fix | Delete

else {

[34] Fix | Delete

$this->_add_cap('administrator', self::CAP_ACTIVATE_2FA_SELF);

[35] Fix | Delete

$this->_add_cap('administrator', self::CAP_ACTIVATE_2FA_OTHERS);

[36] Fix | Delete

$this->_add_cap('administrator', self::CAP_MANAGE_SETTINGS);

[37] Fix | Delete

}

[38] Fix | Delete

}

[39] Fix | Delete

[40] Fix | Delete

public function uninstall() {

[41] Fix | Delete

if (Controller_Settings::shared()->get_bool(Controller_Settings::OPTION_DELETE_ON_DEACTIVATION)) {

[42] Fix | Delete

if (is_multisite()) {

[43] Fix | Delete

$sites = $this->get_sites();

[44] Fix | Delete

foreach ($sites as $id) {

[45] Fix | Delete

switch_to_blog($id);

[46] Fix | Delete

wp_clear_scheduled_hook('wordfence_ls_role_sync_cron');

[47] Fix | Delete

restore_current_blog();

[48] Fix | Delete

}

[49] Fix | Delete

}

[50] Fix | Delete

}

[51] Fix | Delete

}

[52] Fix | Delete

[53] Fix | Delete

public static function _init_actions() {

[54] Fix | Delete

add_action('wordfence_ls_role_sync_cron', array(Controller_Permissions::shared(), '_role_sync_cron'));

[55] Fix | Delete

}

[56] Fix | Delete

[57] Fix | Delete

public function init() {

[58] Fix | Delete

global $wp_version;

[59] Fix | Delete

if (is_multisite()) {

[60] Fix | Delete

if (version_compare($wp_version, '5.1.0', '>=')) {

[61] Fix | Delete

add_action('wp_initialize_site', array($this, '_wp_initialize_site'), 99);

[62] Fix | Delete

}

[63] Fix | Delete

else {

[64] Fix | Delete

add_action('wpmu_new_blog', array($this, '_wpmu_new_blog'), 10, 5);

[65] Fix | Delete

}

[66] Fix | Delete

[67] Fix | Delete

add_action('init', array($this, '_validate_role_sync_cron'), 1);

[68] Fix | Delete

}

[69] Fix | Delete

}

[70] Fix | Delete

[71] Fix | Delete

/**

[72] Fix | Delete

* Syncs roles to the new multisite blog.

[73] Fix | Delete

*

[74] Fix | Delete

* @param $site_id

[75] Fix | Delete

* @param $user_id

[76] Fix | Delete

* @param $domain

[77] Fix | Delete

* @param $path

[78] Fix | Delete

* @param $network_id

[79] Fix | Delete

*/

[80] Fix | Delete

public function _wpmu_new_blog($site_id, $user_id, $domain, $path, $network_id) {

[81] Fix | Delete

$this->sync_roles($network_id, $site_id);

[82] Fix | Delete

}

[83] Fix | Delete

[84] Fix | Delete

/**

[85] Fix | Delete

* Syncs roles to the new multisite blog.

[86] Fix | Delete

*

[87] Fix | Delete

* @param $new_site

[88] Fix | Delete

*/

[89] Fix | Delete

public function _wp_initialize_site($new_site) {

[90] Fix | Delete

$this->sync_roles($new_site->site_id, $new_site->blog_id);

[91] Fix | Delete

}

[92] Fix | Delete

[93] Fix | Delete

/**

[94] Fix | Delete

* Creates the hourly cron (if needed) that handles syncing the roles/permissions for the current blog. Because crons

[95] Fix | Delete

* are specific to individual blogs on multisite rather than to the network itself, this will end up creating a cron

[96] Fix | Delete

* for every member blog of the multisite.

[97] Fix | Delete

*

[98] Fix | Delete

* If there is a new role change since the last sync, a one-off cron will be fired to sync it sooner than the normal

[99] Fix | Delete

* recurrence period.

[100] Fix | Delete

*

[101] Fix | Delete

* Multisite only.

[102] Fix | Delete

*

[103] Fix | Delete

*/

[104] Fix | Delete

public function _validate_role_sync_cron() {

[105] Fix | Delete

if (!wp_next_scheduled('wordfence_ls_role_sync_cron')) {

[106] Fix | Delete

wp_schedule_event(time(), 'hourly', 'wordfence_ls_role_sync_cron');

[107] Fix | Delete

}

[108] Fix | Delete

else {

[109] Fix | Delete

$last_role_change = (int) get_site_option(self::SETTING_LAST_ROLE_CHANGE, 0);

[110] Fix | Delete

if ($last_role_change >= get_option(self::SETTING_LAST_ROLE_SYNC, 0)) {

[111] Fix | Delete

wp_schedule_single_event(time(), 'wordfence_ls_role_sync_cron'); //Force queue an update in case the normal cron is still a while out

[112] Fix | Delete

}

[113] Fix | Delete

}

[114] Fix | Delete

}

[115] Fix | Delete

[116] Fix | Delete

/**

[117] Fix | Delete

* Handles syncing the roles/permissions for the current blog when the cron fires.

[118] Fix | Delete

*/

[119] Fix | Delete

public function _role_sync_cron() {

[120] Fix | Delete

$last_role_change = (int) get_site_option(self::SETTING_LAST_ROLE_CHANGE, 0);

[121] Fix | Delete

if ($last_role_change === 0) {

[122] Fix | Delete

$this->_on_role_change();

[123] Fix | Delete

}

[124] Fix | Delete

[125] Fix | Delete

if ($last_role_change >= get_option(self::SETTING_LAST_ROLE_SYNC, 0)) {

[126] Fix | Delete

$network_id = get_current_site()->id;

[127] Fix | Delete

$blog_id = get_current_blog_id();

[128] Fix | Delete

$this->sync_roles($network_id, $blog_id);

[129] Fix | Delete

update_option(self::SETTING_LAST_ROLE_SYNC, time());

[130] Fix | Delete

}

[131] Fix | Delete

}

[132] Fix | Delete

[133] Fix | Delete

private function _on_role_change() {

[134] Fix | Delete

update_site_option(self::SETTING_LAST_ROLE_CHANGE, time());

[135] Fix | Delete

}

[136] Fix | Delete

[137] Fix | Delete

/**

[138] Fix | Delete

* Get the primary site ID for a given network

[139] Fix | Delete

*/

[140] Fix | Delete

private function get_primary_site_id($network_id) {

[141] Fix | Delete

global $wpdb;

[142] Fix | Delete

if(function_exists('get_network')){

[143] Fix | Delete

$network=get_network($network_id); //TODO: Support multi-network throughout plugin

[144] Fix | Delete

return (int)$network->blog_id;

[145] Fix | Delete

}

[146] Fix | Delete

else{

[147] Fix | Delete

return (int)$wpdb->get_var($wpdb->prepare("SELECT blogs.blog_id FROM {$wpdb->site} sites JOIN {$wpdb->blogs} blogs ON blogs.site_id=sites.id AND blogs.path=sites.path WHERE sites.id=%d", $network_id));

[148] Fix | Delete

}

[149] Fix | Delete

}

[150] Fix | Delete

[151] Fix | Delete

/**

[152] Fix | Delete

* Get all primary sites in a multi-network setup

[153] Fix | Delete

*/

[154] Fix | Delete

private function get_primary_sites() {

[155] Fix | Delete

global $wpdb;

[156] Fix | Delete

if(function_exists('get_networks')){

[157] Fix | Delete

return array_map(function($network){ return $network->blog_id; }, get_networks());

[158] Fix | Delete

}

[159] Fix | Delete

else{

[160] Fix | Delete

return $wpdb->get_col("SELECT blogs.blog_id FROM {$wpdb->site} sites JOIN {$wpdb->blogs} blogs ON blogs.site_id=sites.id AND blogs.path=sites.path");

[161] Fix | Delete

}

[162] Fix | Delete

}

[163] Fix | Delete

[164] Fix | Delete

/**

[165] Fix | Delete

* Returns an array of all multisite `blog_id` values, optionally limiting the result to the subset between

[166] Fix | Delete

* ($from, $from + $count].

[167] Fix | Delete

*

[168] Fix | Delete

* @param int $from

[169] Fix | Delete

* @param int $count

[170] Fix | Delete

* @return array

[171] Fix | Delete

*/

[172] Fix | Delete

private function get_sites($from = 0, $count = 0) {

[173] Fix | Delete

global $wpdb;

[174] Fix | Delete

if ($from === 0 && $count === 0) {

[175] Fix | Delete

return $wpdb->get_col("SELECT `blog_id` FROM `{$wpdb->blogs}` WHERE `deleted` = 0 ORDER BY blog_id ");

[176] Fix | Delete

}

[177] Fix | Delete

return $wpdb->get_col($wpdb->prepare("SELECT `blog_id` FROM `{$wpdb->blogs}` WHERE `deleted` = 0 AND blog_id > %d ORDER BY blog_id LIMIT %d", $from, $count));

[178] Fix | Delete

}

[179] Fix | Delete

[180] Fix | Delete

/**

[181] Fix | Delete

* Sync role capabilities from the default site to a newly added site

[182] Fix | Delete

* @param int $network_id the relevant network

[183] Fix | Delete

* @param int $site_id the newly added site(blog)

[184] Fix | Delete

*/

[185] Fix | Delete

private function sync_roles($network_id, $site_id){

[186] Fix | Delete

if(array_key_exists($network_id, $this->network_roles)){

[187] Fix | Delete

$current_roles=$this->network_roles[$network_id];

[188] Fix | Delete

}

[189] Fix | Delete

else{

[190] Fix | Delete

$current_roles=$this->_wp_roles($this->get_primary_site_id($network_id));

[191] Fix | Delete

$this->network_roles[$network_id]=$current_roles;

[192] Fix | Delete

}

[193] Fix | Delete

$new_site_roles=$this->_wp_roles($site_id);

[194] Fix | Delete

$capabilities=array(

[195] Fix | Delete

self::CAP_ACTIVATE_2FA_SELF,

[196] Fix | Delete

self::CAP_ACTIVATE_2FA_OTHERS,

[197] Fix | Delete

self::CAP_MANAGE_SETTINGS

[198] Fix | Delete

);

[199] Fix | Delete

foreach($current_roles->get_names() as $role_name=>$role_label){

[200] Fix | Delete

if($new_site_roles->get_role($role_name)===null)

[201] Fix | Delete

$new_site_roles->add_role($role_name, $role_label);

[202] Fix | Delete

$role=$current_roles->get_role($role_name);

[203] Fix | Delete

foreach($capabilities as $cap){

[204] Fix | Delete

if($role->has_cap($cap)){

[205] Fix | Delete

$this->_add_cap_multisite($role_name, $cap, array($site_id));

[206] Fix | Delete

}

[207] Fix | Delete

else{

[208] Fix | Delete

$this->_remove_cap_multisite($role_name, $cap, array($site_id));

[209] Fix | Delete

}

[210] Fix | Delete

}

[211] Fix | Delete

}

[212] Fix | Delete

}

[213] Fix | Delete

[214] Fix | Delete

public function allow_2fa_self($role_name) {

[215] Fix | Delete

$this->_on_role_change();

[216] Fix | Delete

if (is_multisite()) {

[217] Fix | Delete

return $this->_add_cap_multisite($role_name, self::CAP_ACTIVATE_2FA_SELF, $this->get_primary_sites());

[218] Fix | Delete

}

[219] Fix | Delete

else {

[220] Fix | Delete

return $this->_add_cap($role_name, self::CAP_ACTIVATE_2FA_SELF);

[221] Fix | Delete

}

[222] Fix | Delete

}

[223] Fix | Delete

[224] Fix | Delete

public function disallow_2fa_self($role_name) {

[225] Fix | Delete

$this->_on_role_change();

[226] Fix | Delete

if (is_multisite()) {

[227] Fix | Delete

return $this->_remove_cap_multisite($role_name, self::CAP_ACTIVATE_2FA_SELF, $this->get_primary_sites());

[228] Fix | Delete

}

[229] Fix | Delete

else {

[230] Fix | Delete

if ($role_name == 'administrator') {

[231] Fix | Delete

return true;

[232] Fix | Delete

}

[233] Fix | Delete

return $this->_remove_cap($role_name, self::CAP_ACTIVATE_2FA_SELF);

[234] Fix | Delete

}

[235] Fix | Delete

}

[236] Fix | Delete

[237] Fix | Delete

public function can_manage_settings($user = false) {

[238] Fix | Delete

if ($user === false) {

[239] Fix | Delete

$user = wp_get_current_user();

[240] Fix | Delete

}

[241] Fix | Delete

[242] Fix | Delete

if (!($user instanceof \WP_User)) {

[243] Fix | Delete

return false;

[244] Fix | Delete

}

[245] Fix | Delete

return $user->has_cap(self::CAP_MANAGE_SETTINGS);

[246] Fix | Delete

}

[247] Fix | Delete

[248] Fix | Delete

public function can_role_manage_settings($role) {

[249] Fix | Delete

if (is_string($role)) {

[250] Fix | Delete

$role = get_role($role);

[251] Fix | Delete

}

[252] Fix | Delete

if ($role)

[253] Fix | Delete

return $role->has_cap(self::CAP_MANAGE_SETTINGS);

[254] Fix | Delete

return false;

[255] Fix | Delete

}

[256] Fix | Delete

[257] Fix | Delete

private function _wp_roles($site_id = null) {

[258] Fix | Delete

require(ABSPATH . 'wp-includes/version.php'); /** @var string $wp_version */

[259] Fix | Delete

if (version_compare($wp_version, '4.9', '>=')) {

[260] Fix | Delete

return new \WP_Roles($site_id);

[261] Fix | Delete

}

[262] Fix | Delete

[263] Fix | Delete

//\WP_Roles in WP < 4.9 initializes based on the current blog ID

[264] Fix | Delete

if (is_multisite()) {

[265] Fix | Delete

switch_to_blog($site_id);

[266] Fix | Delete

}

[267] Fix | Delete

$wp_roles = new \WP_Roles();

[268] Fix | Delete

if (is_multisite()) {

[269] Fix | Delete

restore_current_blog();

[270] Fix | Delete

}

[271] Fix | Delete

return $wp_roles;

[272] Fix | Delete

}

[273] Fix | Delete

[274] Fix | Delete

private function _add_cap_multisite($role_name, $cap, $blog_ids=null) {

[275] Fix | Delete

if ($role_name === 'super-admin')

[276] Fix | Delete

return true;

[277] Fix | Delete

global $wpdb;

[278] Fix | Delete

$blogs = $blog_ids===null?$wpdb->get_col("SELECT `blog_id` FROM `{$wpdb->blogs}` WHERE `deleted` = 0"):$blog_ids;

[279] Fix | Delete

$added = false;

[280] Fix | Delete

foreach ($blogs as $id) {

[281] Fix | Delete

$wp_roles = $this->_wp_roles($id);

[282] Fix | Delete

switch_to_blog($id);

[283] Fix | Delete

$added = $this->_add_cap($role_name, $cap, $wp_roles) || $added;

[284] Fix | Delete

restore_current_blog();

[285] Fix | Delete

}

[286] Fix | Delete

return $added;

[287] Fix | Delete

}

[288] Fix | Delete

[289] Fix | Delete

private function _add_cap($role_name, $cap, $wp_roles = null) {

[290] Fix | Delete

if ($wp_roles === null) { $wp_roles = $this->_wp_roles(); }

[291] Fix | Delete

$role = $wp_roles->get_role($role_name);

[292] Fix | Delete

if ($role === null) {

[293] Fix | Delete

return false;

[294] Fix | Delete

}

[295] Fix | Delete

[296] Fix | Delete

$wp_roles->add_cap($role_name, $cap);

[297] Fix | Delete

return true;

[298] Fix | Delete

}

[299] Fix | Delete

[300] Fix | Delete

private function _remove_cap_multisite($role_name, $cap, $blog_ids=null) {

[301] Fix | Delete

if ($role_name === 'super-admin')

[302] Fix | Delete

return false;

[303] Fix | Delete

global $wpdb;

[304] Fix | Delete

$blogs = $blog_ids===null?$wpdb->get_col("SELECT `blog_id` FROM `{$wpdb->blogs}` WHERE `deleted` = 0"):$blog_ids;

[305] Fix | Delete

$removed = false;

[306] Fix | Delete

foreach ($blogs as $id) {

[307] Fix | Delete

$wp_roles = $this->_wp_roles($id);

[308] Fix | Delete

switch_to_blog($id);

[309] Fix | Delete

$removed = $this->_remove_cap($role_name, $cap, $wp_roles) || $removed;

[310] Fix | Delete

restore_current_blog();

[311] Fix | Delete

}

[312] Fix | Delete

return $removed;

[313] Fix | Delete

}

[314] Fix | Delete

[315] Fix | Delete

private function _remove_cap($role_name, $cap, $wp_roles = null) {

[316] Fix | Delete

if ($wp_roles === null) { $wp_roles = $this->_wp_roles(); }

[317] Fix | Delete

$role = $wp_roles->get_role($role_name);

[318] Fix | Delete

if ($role === null) {

[319] Fix | Delete

return false;

[320] Fix | Delete

}

[321] Fix | Delete

[322] Fix | Delete

$wp_roles->remove_cap($role_name, $cap);

[323] Fix | Delete

return true;

[324] Fix | Delete

}

[325] Fix | Delete

[326] Fix | Delete

/**

[327] Fix | Delete

* Loads the role capability info for the multisite blog IDs in `$includedSites` and appends it to

[328] Fix | Delete

* `$this->multisite_roles`. Role capability data that is already loaded will be skipped.

[329] Fix | Delete

*

[330] Fix | Delete

* @param array $includeSites An array of multisite blog IDs to load.

[331] Fix | Delete

*/

[332] Fix | Delete

private function _load_multisite_roles($includeSites) {

[333] Fix | Delete

global $wpdb;

[334] Fix | Delete

[335] Fix | Delete

$needed = array_diff($includeSites, array_keys($this->multisite_roles));

[336] Fix | Delete

if (empty($needed)) {

[337] Fix | Delete

return;

[338] Fix | Delete

}

[339] Fix | Delete

[340] Fix | Delete

$suffix = "user_roles";

[341] Fix | Delete

$queries = array();

[342] Fix | Delete

foreach ($needed as $b) {

[343] Fix | Delete

$tables = $wpdb->tables('blog', true, $b);

[344] Fix | Delete

$queries[] = "SELECT CAST(option_name AS CHAR UNICODE) AS option_name, CAST(option_value AS CHAR UNICODE) AS option_value FROM {$tables['options']} WHERE option_name LIKE '%{$suffix}'";

[345] Fix | Delete

}

[346] Fix | Delete

[347] Fix | Delete

$chunks = array_chunk($queries, 50);

[348] Fix | Delete

$options = array();

[349] Fix | Delete

foreach ($chunks as $c) {

[350] Fix | Delete

$rows = $wpdb->get_results(implode(' UNION ', $c), OBJECT_K);

[351] Fix | Delete

foreach ($rows as $row) {

[352] Fix | Delete

$options[$row->option_name] = $row->option_value;

[353] Fix | Delete

}

[354] Fix | Delete

}

[355] Fix | Delete

[356] Fix | Delete

$extractor = new Utility_MultisiteConfigurationExtractor($wpdb->base_prefix, $suffix);

[357] Fix | Delete

foreach ($extractor->extract($options) as $site => $option) {

[358] Fix | Delete

$this->multisite_roles[$site] = maybe_unserialize($option);

[359] Fix | Delete

}

[360] Fix | Delete

}

[361] Fix | Delete

[362] Fix | Delete

/**

[363] Fix | Delete

* Returns an array of multisite roles. This is guaranteed to include the multisite blogs in `$includeSites` but may

[364] Fix | Delete

* include others from earlier calls that are cached.

[365] Fix | Delete

*

[366] Fix | Delete

* @param array $includeSites An array for multisite blog IDs.

[367] Fix | Delete

* @return array

[368] Fix | Delete

*/

[369] Fix | Delete

public function get_multisite_roles($includeSites) {

[370] Fix | Delete

if ($this->multisite_roles === null) {

[371] Fix | Delete

$this->multisite_roles = array();

[372] Fix | Delete

}

[373] Fix | Delete

[374] Fix | Delete

$this->_load_multisite_roles($includeSites);

[375] Fix | Delete

return $this->multisite_roles;

[376] Fix | Delete

}

[377] Fix | Delete

[378] Fix | Delete

/**

[379] Fix | Delete

* Returns the sites + roles that a user has on multisite. The structure of the returned array has the keys as the

[380] Fix | Delete

* individual site IDs and the associated value as an array of the user's capabilities on that site.

[381] Fix | Delete

*

[382] Fix | Delete

* @param WP_User $user

[383] Fix | Delete

* @return array

[384] Fix | Delete

*/

[385] Fix | Delete

public function get_multisite_roles_for_user($user) {

[386] Fix | Delete

global $wpdb;

[387] Fix | Delete

$roles = array();

[388] Fix | Delete

$meta = get_user_meta($user->ID);

[389] Fix | Delete

if (is_array($meta)) {

[390] Fix | Delete

$extractor = new Utility_MultisiteConfigurationExtractor($wpdb->base_prefix, 'capabilities');

[391] Fix | Delete

foreach ($extractor->extract($meta) as $site => $capabilities) {

[392] Fix | Delete

if (!is_array($capabilities)) { continue; }

[393] Fix | Delete

$capabilities = array_map('maybe_unserialize', $capabilities);

[394] Fix | Delete

$localRoles = array();

[395] Fix | Delete

foreach ($capabilities as $entry) {

[396] Fix | Delete

foreach ($entry as $role => $state) {

[397] Fix | Delete

if ($state)

[398] Fix | Delete

$localRoles[$role] = true;

[399] Fix | Delete

}

[400] Fix | Delete

}

[401] Fix | Delete

$roles[$site] = array_keys($localRoles);

[402] Fix | Delete

}

[403] Fix | Delete

}

[404] Fix | Delete

return $roles;

[405] Fix | Delete

}

[406] Fix | Delete

[407] Fix | Delete

public function get_all_roles($user) {

[408] Fix | Delete

global $wpdb;

[409] Fix | Delete

if (is_multisite()) {

[410] Fix | Delete

$roles = array();

[411] Fix | Delete

if (is_super_admin($user->ID)) {

[412] Fix | Delete

$roles['super-admin'] = true;

[413] Fix | Delete

}

[414] Fix | Delete

foreach ($this->get_multisite_roles_for_user($user) as $site => $siteRoles) {

[415] Fix | Delete

foreach ($siteRoles as $role) {

[416] Fix | Delete

$roles[$role] = true;

[417] Fix | Delete

}

[418] Fix | Delete

}

[419] Fix | Delete

return array_keys($roles);

[420] Fix | Delete

}

[421] Fix | Delete

else {

[422] Fix | Delete

return $user->roles;

[423] Fix | Delete

}

[424] Fix | Delete

}

[425] Fix | Delete

[426] Fix | Delete

public function does_user_have_multisite_capability($user, $capability) {

[427] Fix | Delete

$userRoles = $this->get_multisite_roles_for_user($user);

[428] Fix | Delete

if (in_array('super-admin', $userRoles)) {

[429] Fix | Delete

return true;

[430] Fix | Delete

}

[431] Fix | Delete

[432] Fix | Delete

$blogRoles = $this->get_multisite_roles(array_keys($userRoles));

[433] Fix | Delete

$blogs = get_blogs_of_user($user->ID);

[434] Fix | Delete

foreach ($blogs as $blogId => $blog) {

[435] Fix | Delete

$blogId = (int) $blogId;

[436] Fix | Delete

if (!array_key_exists($blogId, $userRoles) || !array_key_exists($blogId, $blogRoles)) { continue; } //Blog with ID `$blogId` should be ignored

[437] Fix | Delete

foreach ($userRoles[$blogId] as $userRole) {

[438] Fix | Delete

if (!array_key_exists($userRole, $blogRoles[$blogId]) || !array_key_exists('capabilities', $blogRoles[$blogId][$userRole])) { continue; } //Sanity check for needed keys, should not happen

[439] Fix | Delete

[440] Fix | Delete

$capabilities = $blogRoles[$blogId][$userRole]['capabilities'];

[441] Fix | Delete

if (array_key_exists($capability, $capabilities) && $capabilities[$capability]) { return true; }

[442] Fix | Delete

}

[443] Fix | Delete

}

[444] Fix | Delete

return false;

[445] Fix | Delete

}

[446] Fix | Delete

}

[447] Fix | Delete