I’m running a multisite installation and have a plugin installed that lets users that are given a user meta option to be their specific role on any site that they aren’t associated with. So if they are an admin on the main site (blog 1), they are admins on all sites.
It does this by adding a filter to their capabilities before wordpress checks current_user_can, and applies the role/caps from the main site, which works fine on every single page/part of wordpress, except on the theme customizer.
From what it looks like, customize.php doesn’t run any plugins until after the “sandbox” container is run, and plugins only run inside IFRAME. Since the plugin doesn’t run before customize.php checks the permission/capability levels, and since the user isn’t associated with that site, the check fails and gives the “Cheatin’ uh?” error.
Is there anyway to run a plugin on customize.php before this happens and let’s the page pass the permission check?