Multisite upgrade notice showing to child-blog admins?

[raamdev]

A user reported that the Quick Cache Pro upgrade notice was appearing even for child-blog admins, who don't have permission to upgrade Quick Cache Pro at the network level.

I haven't verified this bug yet, so this needs testing.

---

Reported here: https://websharks.zendesk.com/agent/#/tickets/3342

[jaswrks]

I can take a look at this. Assigning this to myself.

[jaswrks]

Confirmed. This bug is caused by the persistent notice functionality built into Quick Cache. The notice itself is suppressed properly; i.e. the \quick_cache\plugin::$update_cap is required. However, once a persistent notice is generated, it displays in all views with only a permission check against the basic \quick_cache\plugin::$cap property. That's a bug.

[jaswrks]

I should note that it's only the link being displayed that is the issue. I'm not seeing a real security threat here, since the functionality itself is still off limits as it should be in this scenario.

[jaswrks]

Resolved in the feature/259 branch.

[raamdev]

@jaswsinc Thanks! Can you submit a Pull Request for the feature/259 branch when you get a chance?

[raamdev]

@jaswsinc Ha, never mind. I was looking for the PR on the Quick Cache repo. I see the PR on the Quick Cache Pro repo (and how I missed the reference to it before your last comment I'll never know).

[raamdev]

@jaswsinc Thanks for taking care of this!

Closed by Pull Request wpsharks/comet-cache-pro#67