X-Git-Url: https://scripts.mit.edu/gitweb/autoinstallsdev/wordpress.git/blobdiff_plain/7688c6ba71852cd89123b62b2d57683535e4702a..0f74cdeda4c069bfbb9c4131ef1352f55b6f8499:/wp-admin/users.php diff --git a/wp-admin/users.php b/wp-admin/users.php index 7797b2ce..24367647 100644 --- a/wp-admin/users.php +++ b/wp-admin/users.php @@ -1,184 +1,188 @@ ' . __( 'Cheatin’ uh?' ) . '' . + '
' . __( 'Sorry, you are not allowed to list users.' ) . '
', + 403 + ); +} +$wp_list_table = _get_list_table('WP_Users_List_Table'); +$pagenum = $wp_list_table->get_pagenum(); $title = __('Users'); $parent_file = 'users.php'; -$action = $_REQUEST['action']; -$update = ''; - -if ( empty($_POST) ) { - $referer = ''; -} elseif ( isset($_POST['wp_http_referer']) ) { - $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), stripslashes($_POST['wp_http_referer'])); - $referer = ''; +add_screen_option( 'per_page' ); + +// contextual help - choose Help on the top right of admin panel to preview this. +get_current_screen()->add_help_tab( array( + 'id' => 'overview', + 'title' => __('Overview'), + 'content' => '' . __('This screen lists all the existing users for your site. Each user has one of five defined roles as set by the site admin: Site Administrator, Editor, Author, Contributor, or Subscriber. Users with roles other than Administrator will see fewer options in the dashboard navigation when they are logged in, based on their role.') . '
' . + '' . __('To add a new user for your site, click the Add New button at the top of the screen or Add New in the Users menu section.') . '
' +) ) ; + +get_current_screen()->add_help_tab( array( + 'id' => 'screen-display', + 'title' => __('Screen Display'), + 'content' => '' . __('You can customize the display of this screen in a number of ways:') . '
' . + '' . __('Hovering over a row in the users list will display action links that allow you to manage users. You can perform the following actions:') . '
' . + '' . __('For more information:') . '
' . + '' . __('Documentation on Managing Users') . '
' . + '' . __('Descriptions of Roles and Capabilities') . '
' . + '' . __('Support Forums') . '
' +); + +get_current_screen()->set_screen_reader_content( array( + 'heading_views' => __( 'Filter users list' ), + 'heading_pagination' => __( 'Users list navigation' ), + 'heading_list' => __( 'Users list' ), +) ); + +if ( empty($_REQUEST) ) { + $referer = ''; +} elseif ( isset($_REQUEST['wp_http_referer']) ) { + $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), wp_unslash( $_REQUEST['wp_http_referer'] ) ); + $referer = ''; } else { $redirect = 'users.php'; + $referer = ''; } +$update = ''; -// WP_User_Search class -// by Mark Jaquith - - -class WP_User_Search { - var $results; - var $search_term; - var $page; - var $raw_page; - var $users_per_page = 50; - var $first_user; - var $last_user; - var $query_limit; - var $query_from_where; - var $total_users_for_query = 0; - var $too_many_total_users = false; - var $search_errors; - - function WP_User_Search ($search_term = '', $page = '') { // constructor - $this->search_term = $search_term; - $this->raw_page = ( '' == $page ) ? false : (int) $page; - $this->page = (int) ( '' == $page ) ? 1 : $page; - - $this->prepare_query(); - $this->query(); - $this->prepare_vars_for_template_usage(); - $this->do_paging(); - } - - function prepare_query() { - global $wpdb; - $this->first_user = ($this->page - 1) * $this->users_per_page; - $this->query_limit = 'LIMIT ' . $this->first_user . ',' . $this->users_per_page; - if ( $this->search_term ) { - $searches = array(); - $search_sql = 'AND ('; - foreach ( array('user_login', 'user_nicename', 'user_email', 'user_url', 'display_name') as $col ) - $searches[] = $col . " LIKE '%$this->search_term%'"; - $search_sql .= implode(' OR ', $searches); - $search_sql .= ')'; - } - $this->query_from_where = "FROM $wpdb->users WHERE 1=1 $search_sql"; - - } - - function query() { - global $wpdb; - $this->results = $wpdb->get_col('SELECT ID ' . $this->query_from_where . $this->query_limit); - - if ( $this->results ) - $this->total_users_for_query = $wpdb->get_var('SELECT COUNT(ID) ' . $this->query_from_where); // no limit - else - $this->search_errors = new WP_Error('no_matching_users_found', __('No matching users were found!')); - } - - function prepare_vars_for_template_usage() { - $this->search_term = stripslashes($this->search_term); // done with DB, from now on we want slashes gone - } - - function do_paging() { - if ( $this->total_users_for_query > $this->users_per_page ) { // have to page the results - $this->paging_text = paginate_links( array( - 'total' => ceil($this->total_users_for_query / $this->users_per_page), - 'current' => $this->page, - 'prev_text' => __('« Previous Page'), - 'next_text' => __('Next Page »'), - 'base' => 'users.php?%_%', - 'format' => 'userspage=%#%', - 'add_args' => array( 'usersearch' => urlencode($this->search_term) ) - ) ); - } - } - - function get_results() { - return (array) $this->results; - } - - function page_links() { - echo $this->paging_text; - } - - function results_are_paged() { - if ( $this->paging_text ) - return true; - return false; - } - - function is_search() { - if ( $this->search_term ) - return true; - return false; - } -} - - -switch ($action) { +switch ( $wp_list_table->current_action() ) { +/* Bulk Dropdown menu Role changes */ case 'promote': check_admin_referer('bulk-users'); - if (empty($_POST['users'])) { + if ( ! current_user_can( 'promote_users' ) ) + wp_die( __( 'Sorry, you are not allowed to edit this user.' ) ); + + if ( empty($_REQUEST['users']) ) { wp_redirect($redirect); exit(); } - if ( !current_user_can('edit_users') ) - wp_die(__('You can’t edit users.')); + $editable_roles = get_editable_roles(); + $role = false; + if ( ! empty( $_REQUEST['new_role2'] ) ) { + $role = $_REQUEST['new_role2']; + } elseif ( ! empty( $_REQUEST['new_role'] ) ) { + $role = $_REQUEST['new_role']; + } + + if ( ! $role || empty( $editable_roles[ $role ] ) ) { + wp_die( __( 'Sorry, you are not allowed to give users that role.' ) ); + } - $userids = $_POST['users']; + $userids = $_REQUEST['users']; $update = 'promote'; - foreach($userids as $id) { - if ( ! current_user_can('edit_user', $id) ) - wp_die(__('You can’t edit that user.')); - // The new role of the current user must also have edit_users caps - if($id == $current_user->ID && !$wp_roles->role_objects[$_POST['new_role']]->has_cap('edit_users')) { - $update = 'err_admin_role'; - continue; + foreach ( $userids as $id ) { + $id = (int) $id; + + if ( ! current_user_can('promote_user', $id) ) + wp_die(__('Sorry, you are not allowed to edit this user.')); + // The new role of the current user must also have the promote_users cap or be a multisite super admin + if ( $id == $current_user->ID && ! $wp_roles->role_objects[ $role ]->has_cap('promote_users') + && ! ( is_multisite() && is_super_admin() ) ) { + $update = 'err_admin_role'; + continue; } - $user = new WP_User($id); - $user->set_role($_POST['new_role']); + // If the user doesn't already belong to the blog, bail. + if ( is_multisite() && !is_user_member_of_blog( $id ) ) { + wp_die( + '' . __( 'One of the selected users is not a member of this site.' ) . '
', + 403 + ); + } + + $user = get_userdata( $id ); + $user->set_role( $role ); } wp_redirect(add_query_arg('update', $update, $redirect)); exit(); -break; - case 'dodelete': + if ( is_multisite() ) + wp_die( __('User deletion is not allowed from this screen.') ); check_admin_referer('delete-users'); - if ( empty($_POST['users']) ) { + if ( empty($_REQUEST['users']) ) { wp_redirect($redirect); exit(); } - if ( !current_user_can('delete_users') ) - wp_die(__('You can’t delete users.')); + $userids = array_map( 'intval', (array) $_REQUEST['users'] ); + + if ( empty( $_REQUEST['delete_option'] ) ) { + $url = self_admin_url( 'users.php?action=delete&users[]=' . implode( '&users[]=', $userids ) . '&error=true' ); + $url = str_replace( '&', '&', wp_nonce_url( $url, 'bulk-users' ) ); + wp_redirect( $url ); + exit; + } + + if ( ! current_user_can( 'delete_users' ) ) + wp_die(__('Sorry, you are not allowed to delete users.')); - $userids = $_POST['users']; $update = 'del'; $delete_count = 0; - foreach ( (array) $userids as $id) { - if ( ! current_user_can('delete_user', $id) ) - wp_die(__('You can’t delete that user.')); + foreach ( $userids as $id ) { + if ( ! current_user_can( 'delete_user', $id ) ) + wp_die(__( 'Sorry, you are not allowed to delete that user.' ) ); - if($id == $current_user->ID) { + if ( $id == $current_user->ID ) { $update = 'err_admin_del'; continue; } - switch($_POST['delete_option']) { + switch ( $_REQUEST['delete_option'] ) { case 'delete': - wp_delete_user($id); + wp_delete_user( $id ); break; case 'reassign': - wp_delete_user($id, $_POST['reassign_user']); + wp_delete_user( $id, $_REQUEST['reassign_user'] ); break; } ++$delete_count; @@ -188,60 +192,107 @@ case 'dodelete': wp_redirect($redirect); exit(); -break; - case 'delete': + if ( is_multisite() ) + wp_die( __('User deletion is not allowed from this screen.') ); check_admin_referer('bulk-users'); - if ( empty($_POST['users']) ) { + if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) { wp_redirect($redirect); exit(); } - if ( !current_user_can('delete_users') ) - $errors = new WP_Error('edit_users', __('You can’t delete users.')); + if ( ! current_user_can( 'delete_users' ) ) + $errors = new WP_Error( 'edit_users', __( 'Sorry, you are not allowed to delete users.' ) ); - $userids = $_POST['users']; + if ( empty($_REQUEST['users']) ) + $userids = array( intval( $_REQUEST['user'] ) ); + else + $userids = array_map( 'intval', (array) $_REQUEST['users'] ); + + $users_have_content = false; + if ( $wpdb->get_var( "SELECT ID FROM {$wpdb->posts} WHERE post_author IN( " . implode( ',', $userids ) . " ) LIMIT 1" ) ) { + $users_have_content = true; + } elseif ( $wpdb->get_var( "SELECT link_id FROM {$wpdb->links} WHERE link_owner IN( " . implode( ',', $userids ) . " ) LIMIT 1" ) ) { + $users_have_content = true; + } + + if ( $users_have_content ) { + add_action( 'admin_head', 'delete_users_add_js' ); + } - include ('admin-header.php'); + include( ABSPATH . 'wp-admin/admin-header.php' ); ?> -