diff -r 3d4e9c994f10 -r a86126ab1dd4 wp/wp-admin/network/users.php
--- a/wp/wp-admin/network/users.php	Tue Oct 22 16:11:46 2019 +0200
+++ b/wp/wp-admin/network/users.php	Tue Dec 15 13:49:49 2020 +0100
@@ -8,7 +8,7 @@
  */
 
 /** Load WordPress Administration Bootstrap */
-require_once( dirname( __FILE__ ) . '/admin.php' );
+require_once __DIR__ . '/admin.php';
 
 if ( ! current_user_can( 'manage_network_users' ) ) {
 	wp_die( __( 'Sorry, you are not allowed to access this page.' ), 403 );
@@ -27,19 +27,19 @@
 			check_admin_referer( 'deleteuser' );
 
 			$id = intval( $_GET['id'] );
-			if ( $id != '0' && $id != '1' ) {
-				$_POST['allusers'] = array( $id ); // confirm_delete_users() can only handle with arrays
+			if ( $id > 1 ) {
+				$_POST['allusers'] = array( $id ); // confirm_delete_users() can only handle arrays.
 				$title             = __( 'Users' );
 				$parent_file       = 'users.php';
-				require_once( ABSPATH . 'wp-admin/admin-header.php' );
+				require_once ABSPATH . 'wp-admin/admin-header.php';
 				echo '<div class="wrap">';
 				confirm_delete_users( $_POST['allusers'] );
 				echo '</div>';
-				require_once( ABSPATH . 'wp-admin/admin-footer.php' );
+				require_once ABSPATH . 'wp-admin/admin-footer.php';
 			} else {
 				wp_redirect( network_admin_url( 'users.php' ) );
 			}
-			exit();
+			exit;
 
 		case 'allusers':
 			if ( ! current_user_can( 'manage_network_users' ) ) {
@@ -49,7 +49,7 @@
 			if ( ( isset( $_POST['action'] ) || isset( $_POST['action2'] ) ) && isset( $_POST['allusers'] ) ) {
 				check_admin_referer( 'bulk-users-network' );
 
-				$doaction     = $_POST['action'] != -1 ? $_POST['action'] : $_POST['action2'];
+				$doaction     = -1 != $_POST['action'] ? $_POST['action'] : $_POST['action2'];
 				$userfunction = '';
 
 				foreach ( (array) $_POST['allusers'] as $user_id ) {
@@ -61,37 +61,54 @@
 								}
 								$title       = __( 'Users' );
 								$parent_file = 'users.php';
-								require_once( ABSPATH . 'wp-admin/admin-header.php' );
+								require_once ABSPATH . 'wp-admin/admin-header.php';
 								echo '<div class="wrap">';
 								confirm_delete_users( $_POST['allusers'] );
 								echo '</div>';
-								require_once( ABSPATH . 'wp-admin/admin-footer.php' );
-								exit();
+								require_once ABSPATH . 'wp-admin/admin-footer.php';
+								exit;
 
 							case 'spam':
 								$user = get_userdata( $user_id );
 								if ( is_super_admin( $user->ID ) ) {
-									wp_die( sprintf( __( 'Warning! User cannot be modified. The user %s is a network administrator.' ), esc_html( $user->user_login ) ) );
+									wp_die(
+										sprintf(
+											/* translators: %s: User login. */
+											__( 'Warning! User cannot be modified. The user %s is a network administrator.' ),
+											esc_html( $user->user_login )
+										)
+									);
 								}
 
 								$userfunction = 'all_spam';
 								$blogs        = get_blogs_of_user( $user_id, true );
+
 								foreach ( (array) $blogs as $details ) {
-									if ( $details->userblog_id != get_network()->site_id ) { // main blog not a spam !
+									if ( get_network()->site_id != $details->userblog_id ) { // Main blog is not a spam!
 										update_blog_status( $details->userblog_id, 'spam', '1' );
 									}
 								}
-								update_user_status( $user_id, 'spam', '1' );
+
+								$user_data         = $user->to_array();
+								$user_data['spam'] = '1';
+
+								wp_update_user( $user_data );
 								break;
 
 							case 'notspam':
+								$user = get_userdata( $user_id );
+
 								$userfunction = 'all_notspam';
 								$blogs        = get_blogs_of_user( $user_id, true );
+
 								foreach ( (array) $blogs as $details ) {
 									update_blog_status( $details->userblog_id, 'spam', '0' );
 								}
 
-								update_user_status( $user_id, 'spam', '0' );
+								$user_data         = $user->to_array();
+								$user_data['spam'] = '0';
+
+								wp_update_user( $user_data );
 								break;
 						}
 					}
@@ -99,13 +116,13 @@
 
 				if ( ! in_array( $doaction, array( 'delete', 'spam', 'notspam' ), true ) ) {
 					$sendback = wp_get_referer();
+					$user_ids = (array) $_POST['allusers'];
 
-					$user_ids = (array) $_POST['allusers'];
 					/** This action is documented in wp-admin/network/site-themes.php */
-					$sendback = apply_filters( 'handle_network_bulk_actions-' . get_current_screen()->id, $sendback, $doaction, $user_ids );
+					$sendback = apply_filters( 'handle_network_bulk_actions-' . get_current_screen()->id, $sendback, $doaction, $user_ids ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
 
 					wp_safe_redirect( $sendback );
-					exit();
+					exit;
 				}
 
 				wp_safe_redirect(
@@ -125,7 +142,7 @@
 				}
 				wp_redirect( $location );
 			}
-			exit();
+			exit;
 
 		case 'dodelete':
 			check_admin_referer( 'ms-users-delete' );
@@ -140,15 +157,17 @@
 							continue;
 						}
 
-						if ( ! empty( $_POST['delete'] ) && 'reassign' == $_POST['delete'][ $blogid ][ $id ] ) {
-							remove_user_from_blog( $id, $blogid, $user_id );
+						if ( ! empty( $_POST['delete'] ) && 'reassign' === $_POST['delete'][ $blogid ][ $id ] ) {
+							remove_user_from_blog( $id, $blogid, (int) $user_id );
 						} else {
 							remove_user_from_blog( $id, $blogid );
 						}
 					}
 				}
 			}
+
 			$i = 0;
+
 			if ( is_array( $_POST['user'] ) && ! empty( $_POST['user'] ) ) {
 				foreach ( $_POST['user'] as $id ) {
 					if ( ! current_user_can( 'delete_user', $id ) ) {
@@ -159,7 +178,7 @@
 				}
 			}
 
-			if ( $i == 1 ) {
+			if ( 1 === $i ) {
 				$deletefunction = 'delete';
 			} else {
 				$deletefunction = 'all_delete';
@@ -174,7 +193,7 @@
 					network_admin_url( 'users.php' )
 				)
 			);
-			exit();
+			exit;
 	}
 }
 
@@ -220,9 +239,9 @@
 	)
 );
 
-require_once( ABSPATH . 'wp-admin/admin-header.php' );
+require_once ABSPATH . 'wp-admin/admin-header.php';
 
-if ( isset( $_REQUEST['updated'] ) && $_REQUEST['updated'] == 'true' && ! empty( $_REQUEST['action'] ) ) {
+if ( isset( $_REQUEST['updated'] ) && 'true' == $_REQUEST['updated'] && ! empty( $_REQUEST['action'] ) ) {
 	?>
 	<div id="message" class="updated notice is-dismissible"><p>
 		<?php
@@ -259,7 +278,7 @@
 	endif;
 
 	if ( strlen( $usersearch ) ) {
-		/* translators: %s: search keywords */
+		/* translators: %s: Search query. */
 		printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;' ) . '</span>', esc_html( $usersearch ) );
 	}
 	?>
@@ -277,4 +296,4 @@
 	</form>
 </div>
 
-<?php require_once( ABSPATH . 'wp-admin/admin-footer.php' ); ?>
+<?php require_once ABSPATH . 'wp-admin/admin-footer.php'; ?>