From 1d046048fdb8c9a47713b9497718eb7dd9f8b9f9 Mon Sep 17 00:00:00 2001 From: christopherpinnock <44945928+christopherpinnock@users.noreply.github.com> Date: Tue, 15 Oct 2024 14:35:19 -0400 Subject: [PATCH 1/3] super admin Super admins don't need to be granted capabilities, because WordPress grants super admins all capabilities. --- users/roles-and-capabilities/super-admin | 45 ++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 users/roles-and-capabilities/super-admin diff --git a/users/roles-and-capabilities/super-admin b/users/roles-and-capabilities/super-admin new file mode 100644 index 0000000..fd6908a --- /dev/null +++ b/users/roles-and-capabilities/super-admin @@ -0,0 +1,45 @@ +

Super Admin

+ +Super Admin is not a typical role like subscriber, to which capabilities can be granted or revoked; +rather, super admin is a status that can be granted to users when WordPress is in multisite mode. +These users are then granted all capabilities on the network, except where explicitly denied. + +A capability such as read_others_posts can be granted to the subscriber role, by the way of: +add_cap( 'edit_posts' ); +?> + +By default, super admins would have the edit_posts capability and any other capability. +WordPress uses the current_user_can() function to check if the current user has the passed capability, +and this function is what grants all capabilities to super admins. current_user_can is a wrapper function +for user_can(), which calls the has_cap() method on the WP_User object. In the has_cap method, +there exists the code that grants super admin all capabilities: + +ID ) ) { + if ( in_array( 'do_not_allow', $caps, true ) ) { + return false; + } + return true; +} +?> + +The code above checks if WordPress is in multisite mode and if the user in question is a super admin. +If both conditions are met, has_cap returns true if the user is not explicitly denied the capability, +as in 'do_not_allow'. For users who are not super admins, has_cap continues executing and checks +if the user has been explicitly granted the capability, ending with: + + + +As a result, there is no need to explicity grant capablities to super admins, +because super admins are already granted all capabilities by WordPress. From ce6b247bdaf20f8cb56e0cf2dfefcc9adb363eba Mon Sep 17 00:00:00 2001 From: christopherpinnock <44945928+christopherpinnock@users.noreply.github.com> Date: Fri, 27 Feb 2026 15:01:17 -0500 Subject: [PATCH 2/3] Update and rename super-admin to super-admin.md --- users/roles-and-capabilities/super-admin | 45 --------------------- users/roles-and-capabilities/super-admin.md | 35 ++++++++++++++++ 2 files changed, 35 insertions(+), 45 deletions(-) delete mode 100644 users/roles-and-capabilities/super-admin create mode 100644 users/roles-and-capabilities/super-admin.md diff --git a/users/roles-and-capabilities/super-admin b/users/roles-and-capabilities/super-admin deleted file mode 100644 index fd6908a..0000000 --- a/users/roles-and-capabilities/super-admin +++ /dev/null @@ -1,45 +0,0 @@ -

Super Admin

- -Super Admin is not a typical role like subscriber, to which capabilities can be granted or revoked; -rather, super admin is a status that can be granted to users when WordPress is in multisite mode. -These users are then granted all capabilities on the network, except where explicitly denied. - -A capability such as read_others_posts can be granted to the subscriber role, by the way of: -add_cap( 'edit_posts' ); -?> - -By default, super admins would have the edit_posts capability and any other capability. -WordPress uses the current_user_can() function to check if the current user has the passed capability, -and this function is what grants all capabilities to super admins. current_user_can is a wrapper function -for user_can(), which calls the has_cap() method on the WP_User object. In the has_cap method, -there exists the code that grants super admin all capabilities: - -ID ) ) { - if ( in_array( 'do_not_allow', $caps, true ) ) { - return false; - } - return true; -} -?> - -The code above checks if WordPress is in multisite mode and if the user in question is a super admin. -If both conditions are met, has_cap returns true if the user is not explicitly denied the capability, -as in 'do_not_allow'. For users who are not super admins, has_cap continues executing and checks -if the user has been explicitly granted the capability, ending with: - - - -As a result, there is no need to explicity grant capablities to super admins, -because super admins are already granted all capabilities by WordPress. diff --git a/users/roles-and-capabilities/super-admin.md b/users/roles-and-capabilities/super-admin.md new file mode 100644 index 0000000..e6f6f49 --- /dev/null +++ b/users/roles-and-capabilities/super-admin.md @@ -0,0 +1,35 @@ +### Super Admin + +Super Admin is not a typical role like subscriber, to which capabilities can be granted or revoked; rather, super admin is a status that can be granted to users when WordPress is in multisite mode. These users are then granted all capabilities on the network, except where explicitly denied. + +A capability such as **edit_others_posts** can be granted to the subscriber role, by the way of: + +```php +get_role( 'subscriber' )->add_cap( 'edit_others_posts' ); +``` + +By default, super admins would have the **edit_others_posts** capability and any other capabilities. WordPress uses the **current_user_can()** function to check if the current user has the passed capability, and this function is what grants all capabilities to super admins. **current_user_can()** is a wrapper function for **user_can()**, which calls the **has_cap** method on the **WP_User** object. In the **has_cap()** method, there exists the code that grants super admin all capabilities: + +```php +//Multisite super admin has all caps by definition, Unless specifically denied. +if ( is_multisite() && is_super_admin( $this->ID ) ) { + if ( in_array( 'do_not_allow', $caps, true ) ) { + return false; + } + return true; +} +``` + +The code above checks if WordPress is in multisite mode and if the user in question is a super admin. If both conditions are met, **has_cap()** returns true if the user is not explicitly denied the capability, which would be the case if **do_not_allow** is a required capability. For users who are not super admins, has_cap continues executing and checks if the user has been explicitly granted the capability, ending with: + +```php +// Must have ALL requested caps. +foreach ( (array) $caps as $cap ) { + if ( empty( $capabilities[ $cap ] ) ) { + return false; + } +} + +return true; +``` +As a result, there is no need to explicity grant capablities to super admins, because super admins are already granted all capabilities by WordPress. From 9f603a55b7f3a70c717f975f368485af0e523616 Mon Sep 17 00:00:00 2001 From: christopherpinnock <44945928+christopherpinnock@users.noreply.github.com> Date: Fri, 27 Feb 2026 15:02:29 -0500 Subject: [PATCH 3/3] Update super-admin.md --- users/roles-and-capabilities/super-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/users/roles-and-capabilities/super-admin.md b/users/roles-and-capabilities/super-admin.md index e6f6f49..5d61c6e 100644 --- a/users/roles-and-capabilities/super-admin.md +++ b/users/roles-and-capabilities/super-admin.md @@ -8,7 +8,7 @@ A capability such as **edit_others_posts** can be granted to the subscriber role get_role( 'subscriber' )->add_cap( 'edit_others_posts' ); ``` -By default, super admins would have the **edit_others_posts** capability and any other capabilities. WordPress uses the **current_user_can()** function to check if the current user has the passed capability, and this function is what grants all capabilities to super admins. **current_user_can()** is a wrapper function for **user_can()**, which calls the **has_cap** method on the **WP_User** object. In the **has_cap()** method, there exists the code that grants super admin all capabilities: +By default, super admins would have the **edit_others_posts** capability and any other capabilities. WordPress uses the **current_user_can()** function to check if the current user has the passed capability, and this function is what grants all capabilities to super admins. **current_user_can()** is a wrapper function for **user_can()**, which calls the **has_cap()** method on the **WP_User** object. In the **has_cap()** method, there exists the code that grants super admin all capabilities: ```php //Multisite super admin has all caps by definition, Unless specifically denied.