Multisite: Marking a user as a spammer can unintentionally mark legitimate sites as spam as well

[r-a-y]

The problem occurs in bp_core_process_spammer_status().

The call to fetch a user's sites via get_blogs_of_user() doesn't take into account whether other users might be an administrator of the site.

If the site has more than one admin, we shouldn't mark the site as spam since the site might be active.

---

Attached patch includes a fix and unit test.

I opted to replace the call to get_blogs_of_user() with a lighter version that doesn't pull up the site object for each site. This logic is pulled from get_blogs_of_user(): ​https://github.com/WordPress/WordPress/blob/5.4-branch/wp-includes/user.php#L654-L669.

To determine if the site has more than one admin, I'm using count_users().

[imath]

Hi @r-a-y thanks a lot for you ticket/patch and unit test 💪

• I confirm the issue,
• I confirm the patch is fixing it.

Patch looks good to me, let's have it in!

[boonebgorges]

Thanks, @r-a-y - I agree that this is a good approach. Thanks for the patch!

[r-a-y]

In 12665:

Members: When marking a user as a spammer, do not mark sites as spam if the site has more than one administrator.

Previously on a multisite install, we would mark all the spammer's
sites as spam. This is pretty aggressive and could unintentionally
mark legitmiate sites as spam as well.

To address this, we now only mark a site as spam if the spammer is the
sole administrator of the site.

See #8316 (for trunk).

[r-a-y]

In 12666:

Members: When marking a user as a spammer, do not mark sites as spam if the site has more than one administrator.

Previously on a multisite install, we would mark all the spammer's
sites as spam. This is pretty aggressive and could unintentionally
mark legitmiate sites as spam as well.

To address this, we now only mark a site as spam if the spammer is the
sole administrator of the site.

Fixes #8316 (for 6.0 branch).