[Plugin: User Role Editor] WordPress 3.x.x Multisite bug (with details)

Hi,

This seems to be a long standing issue that we have discovered using “User Role Editor” and WP Multisite.

The issue we had was that Editors could not see the “Author” dropdown menu. At first we thought it was a problem when we upgraded WordPress – but actually tracked down to a particular block of code:
File: user-role-editor.php Line: 150

// add where criteria to exclude users with 'Administrator' role from users list
function ure_exclude_superadmins($user_query) {

  global $wpdb;

  // get user_id of users with 'Administrator' role
  $tableName = defined('CUSTOM_USER_META_TABLE') ? CUSTOM_USER_META_TABLE : $wpdb->usermeta;
  $meta_key = $wpdb->base_prefix.'capabilities';
  $admin_role_key = '%"administrator"%';
  $query = "select user_id
              from $tableName
              where meta_key='$meta_key' and meta_value like '$admin_role_key'";
  $ids = implode(',', $ids_arr);
  $user_query->query_where .= " AND $wpdb->users.ID NOT IN ($ids)";

}
// end of ure_exclude_superadmins()

The problem with this code is the query it spits out:

string 'select user_id
              from wp_usermeta
              where meta_key='wp_capabilities' and meta_value like '%"administrator"%'' (length=132)

With Multisite, users capabilities are stored under “wp_blogid_capabilities” which is not taken into account, hence why it fails.

Unfortunately left untreated spits out SQL errors in the backend.

WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') ORDER BY display_name ASC' at line 1 for query SELECT wp_users.ID,wp_users.display_name FROM wp_users INNER JOIN wp_usermeta ON (wp_users.ID = wp_usermeta.user_id) WHERE 1=1 AND ( (wp_usermeta.meta_key = 'wp_38_user_level' AND CAST(wp_usermeta.meta_value AS CHAR) != '0') ) AND wp_users.ID NOT IN () ORDER BY display_name ASC  made by include, do_meta_boxes, call_user_func, post_author_meta_box, wp_dropdown_users, get_users, WP_User_Query->__construct, WP_User_Query->query

There is a fix for this, just amend your $meta_key to along the lines of:

if (is_multisite()) {
    $meta_key = $wpdb->prefix.'capabilities';
  } else {
    $meta_key = $wpdb->base_prefix.'capabilities';
  }

Would appreciate it if you would put this in your next release. Thank you 🙂

http://wordpress.org/extend/plugins/user-role-editor/