WordPress 4.3-scripts

[autoinstalls/wordpress.git] / wp-admin / network / sites.php

diff --git a/wp-admin/network/sites.php b/wp-admin/network/sites.php
index 922ce76532940e9904ffe441eb1eeccd29d8d469..733383acad6e5e6b24bc905e2416caa783c3bf05 100644 (file)
--- a/wp-admin/network/sites.php
+++ b/wp-admin/network/sites.php
@@ -52,8 +52,33 @@ if ( isset( $_GET['action'] ) ) {
        /** This action is documented in wp-admin/network/edit.php */
        do_action( 'wpmuadminedit' );
 
        /** This action is documented in wp-admin/network/edit.php */
        do_action( 'wpmuadminedit' );
 

+       // A list of valid actions and their associated messaging for confirmation output.
+       $manage_actions = array(
+               'activateblog'   => __( 'You are about to activate the site %s' ),
+               'deactivateblog' => __( 'You are about to deactivate the site %s' ),
+               'unarchiveblog'  => __( 'You are about to unarchive the site %s.' ),
+               'archiveblog'    => __( 'You are about to archive the site %s.' ),
+               'unspamblog'     => __( 'You are about to unspam the site %s.' ),
+               'spamblog'       => __( 'You are about to mark the site %s as spam.' ),
+               'deleteblog'     => __( 'You are about to delete the site %s.' ),
+               'unmatureblog'   => __( 'You are about to mark the site %s as mature.' ),
+               'matureblog'     => __( 'You are about to mark the site %s as not mature.' ),
+       );
+

        if ( 'confirm' === $_GET['action'] ) {
        if ( 'confirm' === $_GET['action'] ) {

-               check_admin_referer( 'confirm' );
+               // The action2 parameter contains the action being taken on the site.
+               $site_action = $_GET['action2'];
+
+               if ( ! array_key_exists( $site_action, $manage_actions ) ) {
+                       wp_die( __( 'The requested action is not valid.' ) );
+               }
+
+               // The mature/unmature UI exists only as external code. Check the "confirm" nonce for backward compatibility.
+               if ( 'matureblog' === $site_action || 'unmatureblog' === $site_action ) {
+                       check_admin_referer( 'confirm' );
+               } else {
+                       check_admin_referer( $site_action . '_' . $id );
+               }

 
                if ( ! headers_sent() ) {
                        nocache_headers();
 
                if ( ! headers_sent() ) {
                        nocache_headers();


@@ -64,35 +89,34 @@ if ( isset( $_GET['action'] ) ) {
                        wp_die( __( 'You are not allowed to change the current site.' ) );
                }
 
                        wp_die( __( 'You are not allowed to change the current site.' ) );
                }
 

+               $site_details = get_blog_details( $id );
+               $site_address = untrailingslashit( $site_details->domain . $site_details->path );
+

                require_once( ABSPATH . 'wp-admin/admin-header.php' );
                ?>
                        <div class="wrap">
                require_once( ABSPATH . 'wp-admin/admin-header.php' );
                ?>
                        <div class="wrap">

-                               <h2><?php _e( 'Confirm your action' ); ?></h2>
-                               <form action="sites.php?action=<?php echo esc_attr( $_GET['action2'] ) ?>" method="post">
-                                       <input type="hidden" name="action" value="<?php echo esc_attr( $_GET['action2'] ) ?>" />
+                               <h1><?php _e( 'Confirm your action' ); ?></h1>
+                               <form action="sites.php?action=<?php echo esc_attr( $site_action ); ?>" method="post">
+                                       <input type="hidden" name="action" value="<?php echo esc_attr( $site_action ); ?>" />

                                        <input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" />
                                        <input type="hidden" name="_wp_http_referer" value="<?php echo esc_attr( wp_get_referer() ); ?>" />
                                        <input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" />
                                        <input type="hidden" name="_wp_http_referer" value="<?php echo esc_attr( wp_get_referer() ); ?>" />

-                                       <?php wp_nonce_field( $_GET['action2'], '_wpnonce', false ); ?>
-                                       <p><?php echo esc_html( wp_unslash( $_GET['msg'] ) ); ?></p>
+                                       <?php wp_nonce_field( $site_action . '_' . $id, '_wpnonce', false ); ?>
+                                       <p><?php echo sprintf( $manage_actions[ $site_action ], $site_address ); ?></p>

                                        <?php submit_button( __( 'Confirm' ), 'button' ); ?>
                                </form>
                        </div>
                <?php
                require_once( ABSPATH . 'wp-admin/admin-footer.php' );
                exit();
                                        <?php submit_button( __( 'Confirm' ), 'button' ); ?>
                                </form>
                        </div>
                <?php
                require_once( ABSPATH . 'wp-admin/admin-footer.php' );
                exit();

+       } elseif ( array_key_exists( $_GET['action'], $manage_actions ) ) {
+               $action = $_GET['action'];
+               check_admin_referer( $action . '_' . $id );
+       } elseif ( 'allblogs' === $_GET['action'] ) {
+               check_admin_referer( 'bulk-sites' );

        }
 
        $updated_action = '';
 
        }
 
        $updated_action = '';
 

-       $manage_actions = array( 'deleteblog', 'allblogs', 'archiveblog', 'unarchiveblog', 'activateblog', 'deactivateblog', 'unspamblog', 'spamblog', 'unmatureblog', 'matureblog' );
-       if ( in_array( $_GET['action'], $manage_actions ) ) {
-               $action = $_GET['action'];
-               if ( 'allblogs' === $action )
-                       $action = 'bulk-sites';
-
-               check_admin_referer( $action );
-       }
-

        switch ( $_GET['action'] ) {
 
                case 'deleteblog':
        switch ( $_GET['action'] ) {
 
                case 'deleteblog':


@@ -178,8 +202,9 @@ if ( isset( $_GET['action'] ) ) {
                break;
        }
 
                break;
        }
 

-       if ( empty( $updated_action ) && in_array( $_GET['action'], $manage_actions ) )
+       if ( empty( $updated_action ) && array_key_exists( $_GET['action'], $manage_actions ) ) {

                $updated_action = $_GET['action'];
                $updated_action = $_GET['action'];

+       }

 
        if ( ! empty( $updated_action ) ) {
                wp_safe_redirect( add_query_arg( array( 'updated' => $updated_action ), wp_get_referer() ) );
 
        if ( ! empty( $updated_action ) ) {
                wp_safe_redirect( add_query_arg( array( 'updated' => $updated_action ), wp_get_referer() ) );


@@ -248,16 +273,16 @@ require_once( ABSPATH . 'wp-admin/admin-header.php' );
 ?>
 
 <div class="wrap">
 ?>
 
 <div class="wrap">

-<h2><?php _e( 'Sites' ) ?>
+<h1><?php _e( 'Sites' ); ?>

 
 <?php if ( current_user_can( 'create_sites') ) : ?>
 
 <?php if ( current_user_can( 'create_sites') ) : ?>

-       <a href="<?php echo network_admin_url('site-new.php'); ?>" class="add-new-h2"><?php echo esc_html_x( 'Add New', 'site' ); ?></a>
+       <a href="<?php echo network_admin_url('site-new.php'); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'site' ); ?></a>

 <?php endif; ?>
 
 <?php if ( isset( $_REQUEST['s'] ) && $_REQUEST['s'] ) {
        printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;' ) . '</span>', esc_html( $s ) );
 } ?>
 <?php endif; ?>
 
 <?php if ( isset( $_REQUEST['s'] ) && $_REQUEST['s'] ) {
        printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;' ) . '</span>', esc_html( $s ) );
 } ?>

-</h2>
+</h1>

 
 <?php echo $msg; ?>
 
 
 <?php echo $msg; ?>