| @@ -1046,25 +1046,12 @@ | ||
| 1046 | 1046 | if ( ! $user_id ) { |
| 1047 | 1047 | wp_send_json_error( __( 'Invalid user ID.', 'vigilante' ) ); |
| 1048 | 1048 | } |
| 1049 | 1049 | |
| 1050 | - /* | |
| 1051 | - * Permission over that account, which on a network only a network | |
| 1052 | - * administrator has (wp-includes/capabilities.php:75). Same rule the other | |
| 1053 | - * account tools got in 2.10.3, kept here in 2.11.8. | |
| 1054 | - * | |
| 1055 | - * The reason written here until 2.11.10 was that the pending flag is one | |
| 1056 | - * user meta shared by the whole network, and that stopped being true in | |
| 1057 | - * this very release: the flag is per site now and approving clears only | |
| 1058 | - * this site's. The check stays all the same, and deliberately. Approving | |
| 1059 | - * is what lets somebody into a network whose session cookie is valid on | |
| 1060 | - * every site of it, and the queue is shown to a site administrator so they | |
| 1061 | - * can see who is waiting, with the button locked and explained, which is | |
| 1062 | - * how it has behaved since 2.11.8 and what matriz-red-limpieza-2114.sh | |
| 1063 | - * checks. Loosening it is a decision about who may let people into a | |
| 1064 | - * network, not a tidy-up, so it belongs with the rest of the network | |
| 1065 | - * permissions work in 3.1.0 and not in a security release. | |
| 1066 | - */ | |
| 1050 | + // The pending flag is a user meta, shared by every site of a network, and | |
| 1051 | + // approving opens the login everywhere. Same rule the other account tools | |
| 1052 | + // got in 2.10.3: permission over that user, which on a network only a | |
| 1053 | + // network administrator has (2.11.8). | |
| 1067 | 1054 | if ( ! current_user_can( 'edit_user', $user_id ) ) { |
| 1068 | 1055 | wp_send_json_error( __( 'Permission denied.', 'vigilante' ) ); |
| 1069 | 1056 | } |
| 1070 | 1057 | |
