Ticket #15866: 15866.2.diff

wp-admin/network/menu.php

@@ -61 +61 @@
 $update_title = !empty($update_title) ? esc_attr(implode(', ', $update_title)) : '';
 
 $menu[30] = array(sprintf( __('Updates %s'), "<span class='update-plugins count-$update_count' title='$update_title'><span class='update-count'>" . number_format_i18n($update_count) . "</span></span>" ), 'manage_network', 'upgrade.php', '', 'menu-top menu-icon-tools', 'menu-update', 'div');
-$submenu[ 'upgrade.php' ][10] = array( __( 'Updates' ), 'install_plugins',  'update-core.php' );
+$submenu[ 'upgrade.php' ][10] = array( __( 'Updates' ), 'update_core',  'update-core.php' );
 $submenu[ 'upgrade.php' ][15] = array( __( 'Update Network' ), 'manage_network', 'upgrade.php' );
 unset($plugin_update_count, $theme_update_count, $wordpress_update_count, $update_count, $update_title, $update_themes, $update_plugins, $update_wordpress);
 

wp-admin/menu.php

@@ -51 +51 @@
 
         $update_title = !empty($update_title) ? esc_attr(implode(', ', $update_title)) : '';
 
-        $submenu[ 'index.php' ][10] = array( sprintf( __('Updates %s'), "<span class='update-plugins count-$update_count' title='$update_title'><span class='update-count'>" . number_format_i18n($update_count) . "</span></span>" ), 'install_plugins',  'update-core.php');
+        $submenu[ 'index.php' ][10] = array( sprintf( __('Updates %s'), "<span class='update-plugins count-$update_count' title='$update_title'><span class='update-count'>" . number_format_i18n($update_count) . "</span></span>" ), 'update_core',  'update-core.php');
         unset($plugin_update_count, $theme_update_count, $wordpress_update_count, $update_count, $update_title, $update_themes, $update_plugins, $update_wordpress);
 }
 

wp-admin/update-core.php

@@ -14 +14 @@
         exit();
 }
 
-if ( ! current_user_can( 'update_plugins' ) )
+if ( ! current_user_can( 'update_core' ) )
         wp_die( __( 'You do not have sufficient permissions to update this site.' ) );
 
 function list_core_update( $update ) {
@@ -164 +164 @@
         echo '<p>' . __( 'While your site is being updated, it will be in maintenance mode. As soon as your updates are complete, your site will return to normal.' ) . '</p>';
         dismissed_updates();
 
-        list_plugin_updates();
-        list_theme_updates();
+        if ( current_user_can( 'update_plugins' ) )
+                list_plugin_updates();
+        if ( current_user_can( 'update_themes' ) )
+                list_theme_updates();
         do_action('core_upgrade_preamble');
         echo '</div>';
 }
@@ -406 +408 @@
 );
 
 if ( 'upgrade-core' == $action ) {
+
         wp_version_check();
         require_once(ABSPATH . 'wp-admin/admin-header.php');
         core_upgrade_preamble();
+
 } elseif ( 'do-core-upgrade' == $action || 'do-core-reinstall' == $action ) {
         check_admin_referer('upgrade-core');
 
@@ -429 +433 @@
                 do_core_upgrade($reinstall);
 
 } elseif ( 'do-plugin-upgrade' == $action ) {
+
+        if ( ! current_user_can( 'update_plugins' ) )
+                wp_die( __( 'You do not have sufficient permissions to update this site.' ) );
+
         check_admin_referer('upgrade-core');
 
         if ( isset( $_GET['plugins'] ) ) {
@@ -451 +459 @@
         echo '<h2>' . esc_html__('Update Plugins') . '</h2>';
         echo "<iframe src='$url' style='width: 100%; height: 100%; min-height: 750px;' frameborder='0'></iframe>";
         echo '</div>';
+
 } elseif ( 'do-theme-upgrade' == $action ) {
+
+        if ( ! current_user_can( 'update_themes' ) )
+                wp_die( __( 'You do not have sufficient permissions to update this site.' ) );
+
         check_admin_referer('upgrade-core');
 
         if ( isset( $_GET['themes'] ) ) {