gocodebox / lifterlms

LifterLMS, a WordPress LMS Solution: Easily create, sell, and protect engaging online courses.
https://lifterlms.com
GNU General Public License v3.0
174 stars 134 forks source link

Add filter to prevent current user with an "administrator" or lms_manager" role from being changed to an "instructor" #2569

Closed bsetiawan88 closed 3 months ago

bsetiawan88 commented 8 months ago

Description

Upon closer examination of the role change process in WordPress core, it becomes evident that the default WordPress check for changing a user's role from administrator to editor fails at https://github.com/WordPress/WordPress/blob/master/wp-admin/users.php#L148. It's crucial to recognize that the correct capability name for this check is promote_users rather than edit_users. Consequently, relying on the handle_bulk_actions-users.php filter to enforce this restriction is not a viable approach. To achieve the same outcome as observed in the WordPress core, the role_has_cap filter is utilized as an alternative. Within this filter, the necessary checks and adjustments are made, ensuring that administrator and lms_manager are prevented from changing their roles to instructor.

Fixes #1100

How has this been tested?

Manually change current user role to instructor.

Screenshots

Types of changes

Checklist:

ideadude commented 3 months ago

Closed in favor of a core WP update that we will push for.

Some discussion here: https://github.com/gocodebox/lifterlms/issues/1100#issuecomment-2035509215

Thanks for the contribution anyway @bsetiawan88