Ticket #13074: list-users.diff

wp-includes/version.php

@@ -15 +15 @@
  *
  * @global int $wp_db_version
  */
-$wp_db_version = 14138;
+$wp_db_version = 14139;
 
 /**
  * Holds the TinyMCE version

wp-includes/capabilities.php

@@ -806 +806 @@
                 $caps[] = 'promote_users';
                 break;
         case 'edit_user':
-                if ( !isset( $args[0] ) || $user_id != $args[0] ) {
-                        $caps[] = 'edit_users';
-                }
+                // Allow user to edit itself
+                if ( isset( $args[0] ) && $user_id == $args[0] )
+                        break;
+                // Fall through
+        case 'edit_users':
+                // If multisite these caps are allowed only for super admins.
+                if ( is_multisite() && !is_super_admin() )
+                        $caps[] = 'do_not_allow';
+                else
+                        $caps[] = $cap;
                 break;
         case 'delete_post':
                 $author_data = get_userdata( $user_id );

wp-admin/users.php

@@ -12 +12 @@
 /** WordPress Registration API */
 require_once( ABSPATH . WPINC . '/registration.php');
 
-if ( !current_user_can('edit_users') )
+if ( !current_user_can('list_users') )
         wp_die(__('Cheatin’ uh?'));
 
 $title = __('Users');

wp-admin/includes/upgrade.php

@@ -440 +440 @@
         if ( $wp_current_db_version < 11958 )
                 upgrade_290();
 
-        if ( $wp_current_db_version < 14138 )
+        if ( $wp_current_db_version < 14139 )
                 upgrade_300();
 
         maybe_disable_automattic_widgets();
@@ -1108 +1108 @@
 function upgrade_300() {
         global $wp_current_db_version, $wpdb;
 
-        if ( $wp_current_db_version < 12751 ) {
+        if ( $wp_current_db_version < 14139 ) {
                 populate_roles_300();
                 if ( is_multisite() && is_main_site() && ! defined( 'MULTISITE' ) && get_site_option( 'siteurl' ) === false )
                         add_site_option( 'siteurl', '' );

wp-admin/includes/schema.php

@@ -607 +607 @@
 
         if ( !empty( $role ) ) {
                 $role->add_cap( 'update_core' );
+                $role->add_cap( 'list_users' );
                 $role->add_cap( 'remove_users' );
                 $role->add_cap( 'add_users' );
                 $role->add_cap( 'promote_users' );

wp-admin/includes/template.php

@@ -1812 +1812 @@
                 $short_url = substr( $short_url, 0, 32 ).'...';
         $checkbox = '';
         // Check if the user for this row is editable
-        if ( current_user_can( 'edit_user', $user_object->ID ) ) {
+        if ( current_user_can( 'list_users', $user_object->ID ) ) {
                 // Set up the user editing link
                 // TODO: make profile/user-edit determination a separate function
                 if ($current_user->ID == $user_object->ID) {
@@ -1824 +1824 @@
 
                 // Set up the hover actions for this user
                 $actions = array();
-                $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
+
+                if ( current_user_can('edit_user',  $user_object->ID) )
+                        $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
                 if ( !is_multisite() && $current_user->ID != $user_object->ID && current_user_can('delete_user', $user_object->ID) )
                         $actions['delete'] = "<a class='submitdelete' href='" . wp_nonce_url("users.php?action=delete&amp;user=$user_object->ID", 'bulk-users') . "'>" . __('Delete') . "</a>";
                 if ( is_multisite() && $current_user->ID != $user_object->ID && current_user_can('remove_user', $user_object->ID) )

wp-admin/menu.php

@@ -172 +172 @@
 }
 unset($menu_perms, $update_plugins, $update_count);
 
-if ( current_user_can('edit_users') )
-        $menu[70] = array( __('Users'), 'edit_users', 'users.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
+if ( current_user_can('list_users') )
+        $menu[70] = array( __('Users'), 'list_users', 'users.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
 else
         $menu[70] = array( __('Profile'), 'read', 'profile.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
 
-if ( current_user_can('edit_users') ) {
+if ( current_user_can('list_users') ) {
         $_wp_real_parent_file['profile.php'] = 'users.php'; // Back-compat for plugins adding submenus to profile.php.
-        $submenu['users.php'][5] = array(__('Authors & Users'), 'edit_users', 'users.php');
+        $submenu['users.php'][5] = array(__('Authors & Users'), 'list_users', 'users.php');
         $submenu['users.php'][10] = array(_x('Add New', 'user'), 'create_users', 'user-new.php');
 
         $submenu['users.php'][15] = array(__('Your Profile'), 'read', 'profile.php');