'active_sitewide_plugins' vs 'active_plugins' – Why are keys and value switched?

Hi,

I’m working on a plugin to prohibit non authorized users to deactivate or update plugins, just like moving the plugins to the mu-plugins folder would, but without prohibiting the superadmin to do those things. So the plugins stay in the plugin folder and non authorized users and admins can’t update or deactivate them. The superadmin (and authorized admins for Single Site WordPress installations) can even specify the load order for the plugins (in case of modular, non public plugins that depend on one another).

Everything is working fine without WordPress Multisite, because it does not sort the activated plugins by name, but by the order inside the active_plugins option. If you need to, you can change the sequence of those array items and change the load order.

However for WordPress Multisite it does not work this way for active sitewide plugins. After checking the core I found out, that WordPress Multisite gets the sitewide active plugins from the ‘active_sitewide_plugins’ sitemeta field and sorts them by their key, which is the relative path to the plugin file and not the plugin id in the array, like it is in the ‘active_plugins’ field (see wp_get_active_network_plugins() in wp-include/ms-load.php).

function wp_get_active_network_plugins() {
	$active_plugins = (array) get_site_option( 'active_sitewide_plugins', array() );
	if ( empty( $active_plugins ) )
		return array();

	$plugins = array();
	$active_plugins = array_keys( $active_plugins );
	sort( $active_plugins );

	foreach ( $active_plugins as $plugin ) {
		if ( ! validate_file( $plugin ) // $plugin must validate as file
			&& '.php' == substr( $plugin, -4 ) // $plugin must end with '.php'
			&& file_exists( WP_PLUGIN_DIR . '/' . $plugin ) // $plugin must exist
			)
		$plugins[] = WP_PLUGIN_DIR . '/' . $plugin;
	}
	return $plugins;
}

So now I can’t specify the load order for sidewide active plugins, what causes some plugins that depend on one another to break.

Why does WordPress Multisite do this? Is there a way to get around this? I could just require the plugin files manualy but would ignore the activation hook for the plugins that use one…