fix: connections only manageable for users the admin may edit

2026-09-26 05:05:27 +02:00
parent 9634ca740d
commit 8d0979cb73
2 changed files with 27 additions and 1 deletions
@@ -87,9 +87,17 @@ class ConnectionRepository
        return \WP_Application_Passwords::delete_application_password($userId, $uuid) === true;
    }

-    /** Whether the current administrator may see and revoke this user's connections. */
+    /**
+     * Whether the current administrator may see and revoke this user's connections: only for
+     * users they may edit (edit_user, as for application passwords in the profile), and on
+     * multisite only members of this site, super admins only for other super admins.
+     */
    private function manageable(int $userId): bool
    {
+        if (! current_user_can('edit_user', $userId)) {
+            return false;
+        }
+
        if (! is_multisite()) {
            return true;
        }