X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/3f5685912e89eb3b0534acd85aa0946b1ca2bbe3..a5227bf01edbe6660486c9f5c0f0ed7b7fea3130:/wp-admin/users.php?ds=sidebyside diff --git a/wp-admin/users.php b/wp-admin/users.php index d11ee53d..aeaabc3b 100644 --- a/wp-admin/users.php +++ b/wp-admin/users.php @@ -7,17 +7,28 @@ */ /** WordPress Administration Bootstrap */ -require_once('admin.php'); +require_once('./admin.php'); /** WordPress Registration API */ require_once( ABSPATH . WPINC . '/registration.php'); -if ( !current_user_can('edit_users') ) +if ( !current_user_can('list_users') ) wp_die(__('Cheatin’ uh?')); $title = __('Users'); $parent_file = 'users.php'; +// contextual help - choose Help on the top right of admin panel to preview this. +add_contextual_help($current_screen, + '
' . __('This screen lists all the existing users for your site. Each user has one of five defined roles as set by the site admin: Site Administrator, Editor, Author, Contributor, or Subscriber. Users with roles other than Administrator will see fewer options when they are logged in, based on their role.') . '
' . + '' . __('You can customize the display of information on this screen as you can on other screens, by using the Screen Options tab and the on-screen filters.') . '
' . + '' . __('To add a new user for your site, click the Add New button at the top of the screen or Add New in the Users menu section.') . '
' . + '' . __('For more information:') . '
' . + '' . __('Documentation on Authors and Users') . '
' . + '' . __('Roles and Capabilities Descriptions') . '
' . + '' . __('Support Forums') . '
' +); + $update = $doaction = ''; if ( isset($_REQUEST['action']) ) $doaction = $_REQUEST['action'] ? $_REQUEST['action'] : $_REQUEST['action2']; @@ -43,26 +54,32 @@ switch ($doaction) { case 'promote': check_admin_referer('bulk-users'); - if (empty($_REQUEST['users'])) { + if ( empty($_REQUEST['users']) ) { wp_redirect($redirect); exit(); } $editable_roles = get_editable_roles(); - if (!$editable_roles[$_REQUEST['new_role']]) + if ( empty( $editable_roles[$_REQUEST['new_role']] ) ) wp_die(__('You can’t give users that role.')); $userids = $_REQUEST['users']; $update = 'promote'; - foreach($userids as $id) { - if ( ! current_user_can('edit_user', $id) ) + foreach ( $userids as $id ) { + $id = (int) $id; + + if ( ! current_user_can('promote_user', $id) ) wp_die(__('You can’t edit that user.')); - // The new role of the current user must also have edit_users caps - if($id == $current_user->ID && !$wp_roles->role_objects[$_REQUEST['new_role']]->has_cap('edit_users')) { + // The new role of the current user must also have promote_users caps + if ( $id == $current_user->ID && !$wp_roles->role_objects[$_REQUEST['new_role']]->has_cap('promote_users') ) { $update = 'err_admin_role'; continue; } + // If the user doesn't already belong to the blog, bail. + if ( is_multisite() && !is_user_member_of_blog( $id ) ) + wp_die(__('Cheatin’ uh?')); + $user = new WP_User($id); $user->set_role($_REQUEST['new_role']); } @@ -73,6 +90,8 @@ case 'promote': break; case 'dodelete': + if ( is_multisite() ) + wp_die( __('User deletion is not allowed from this screen.') ); check_admin_referer('delete-users'); @@ -81,7 +100,7 @@ case 'dodelete': exit(); } - if ( !current_user_can('delete_users') ) + if ( ! current_user_can( 'delete_users' ) ) wp_die(__('You can’t delete users.')); $userids = $_REQUEST['users']; @@ -89,19 +108,23 @@ case 'dodelete': $delete_count = 0; foreach ( (array) $userids as $id) { - if ( ! current_user_can('delete_user', $id) ) - wp_die(__('You can’t delete that user.')); + $id = (int) $id; + + if ( ! current_user_can( 'delete_user', $id ) ) + wp_die(__( 'You can’t delete that user.' ) ); - if($id == $current_user->ID) { + if ( $id == $current_user->ID ) { $update = 'err_admin_del'; continue; } - switch($_REQUEST['delete_option']) { + switch ( $_REQUEST['delete_option'] ) { case 'delete': - wp_delete_user($id); + if ( current_user_can('delete_user', $id) ) + wp_delete_user($id); break; case 'reassign': - wp_delete_user($id, $_REQUEST['reassign_user']); + if ( current_user_can('delete_user', $id) ) + wp_delete_user($id, $_REQUEST['reassign_user']); break; } ++$delete_count; @@ -114,6 +137,8 @@ case 'dodelete': break; case 'delete': + if ( is_multisite() ) + wp_die( __('User deletion is not allowed from this screen.') ); check_admin_referer('bulk-users'); @@ -122,8 +147,8 @@ case 'delete': exit(); } - if ( !current_user_can('delete_users') ) - $errors = new WP_Error('edit_users', __('You can’t delete users.')); + if ( ! current_user_can( 'delete_users' ) ) + $errors = new WP_Error( 'edit_users', __( 'You can’t delete users.' ) ); if ( empty($_REQUEST['users']) ) $userids = array(intval($_REQUEST['user'])); @@ -153,7 +178,13 @@ case 'delete': $go_delete = true; } } - $all_logins = $wpdb->get_results("SELECT ID, user_login FROM $wpdb->users ORDER BY user_login"); + // @todo Delete is always for !is_multisite(). Use API. + if ( !is_multisite() ) { + $all_logins = $wpdb->get_results("SELECT ID, user_login FROM $wpdb->users ORDER BY user_login"); + } else { + // WPMU only searches users of current blog + $all_logins = $wpdb->get_results("SELECT ID, user_login FROM $wpdb->users, $wpdb->usermeta WHERE $wpdb->users.ID = $wpdb->usermeta.user_id AND meta_key = '".$wpdb->prefix."capabilities' ORDER BY user_login"); + } $user_dropdown = '