From 8d6108baa4a88f00ab824f2204e54682f645e5f6 Mon Sep 17 00:00:00 2001 From: ryan Date: Sun, 6 Jun 2010 15:05:18 +0000 Subject: [PATCH] Don't allow promoting a user that doesn't already belong to the blog. git-svn-id: http://svn.automattic.com/wordpress/trunk@15150 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/users.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/wp-admin/users.php b/wp-admin/users.php index b92f99412..63ad567bb 100644 --- a/wp-admin/users.php +++ b/wp-admin/users.php @@ -74,6 +74,10 @@ case 'promote': continue; } + // If the user doesn't already belong to the blog, bail. + if ( !is_user_member_of_blog( $id ) ) + wp_die(__('Cheatin’ uh?')); + $user = new WP_User($id); $user->set_role($_REQUEST['new_role']); }