orangebubble

I found an issue with multisites – user could edit other sites themes from the admin bar theme menu even if they didnt have the access to the other multisite sites!!

Add the following code above line 19 which states
$wp_admin_bar->add_menu( array(

Add this code:

$admin_access = apply_filters( 'et_showcontrol_panel', current_user_can('switch_themes') );
	if ( !$admin_access ) return;

The code should now look like this:

function add_theme_selector( $wp_admin_bar ) {

	if (is_user_logged_in() && (!isset($_REQUEST['template']) || $_REQUEST['template']=='')) 

	$admin_access = apply_filters( 'et_showcontrol_panel', current_user_can('switch_themes') );
	if ( !$admin_access ) return;
		$wp_admin_bar->add_menu( array(
		'title' => __( 'Change Theme', 'direitoamoradia' ) ,
		'id' => 'change_theme',
		'href' => get_bloginfo('url').'/?customize=true' )
	);	

}
add_action( 'admin_bar_menu', 'add_theme_selector' );