Ticket #1645: users.php.2.patch

users.php

@@ -20 +20 @@
                 die(__('You can’t edit users.'));
 
         $userids = $_POST['users'];
+        $update = 'promote';
         foreach($userids as $id) {
+                // The new role of the current user must also have edit_users caps
+                if($id == $current_user->id && !$wp_roles->role_objects[$_POST['new_role']]->has_cap('edit_users')) {
+                        $update = 'err_admin_role';
+                        continue;
+                }
+
                 $user = new WP_User($id);
                 $user->set_role($_POST['new_role']);
         }
-                
-        header('Location: users.php?update=promote');
 
+        header('Location: users.php?update=' . $update);
+
 break;
 
 case 'dodelete':
@@ -42 +49 @@
 
         $userids = $_POST['users'];
         
+        $update = 'del';
         foreach($userids as $id) {
+                if($id == $current_user->id) {
+                        $update = 'err_admin_del';
+                        continue;
+                }
                 switch($_POST['delete_option']) {
                 case 'delete':
                         wp_delete_user($id);
@@ -53 +65 @@
                 }
         }
 
-        header('Location: users.php?update=del');
+        header('Location: users.php?update=' . $update);
 
 break;
 
@@ -78 +90 @@
         <p><?php _e('You have specified these users for deletion:'); ?></p>
         <ul>
         <?php
+        $go_delete = false;
         foreach($userids as $id) {
                 $user = new WP_User($id);
-                echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />";
-                echo "{$id}: {$user->data->user_login}</li>\n";
+                if($id == $current_user->id) {
+                        echo "<li>" . sprintf('ID #%1s: %2s <strong>The current user will not be deleted.</strong>', $id, $user->data->user_login) . "</li>\n";
+                }
+                else {
+                        echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />" . sprintf('ID #%1s: %2s', $id, $user->data->user_login) . "</li>\n";
+                        $go_delete = true;
+                }
         }
         $all_logins = $wpdb->get_results("SELECT ID, user_login FROM $wpdb->users ORDER BY user_login");
         $user_dropdown = '<select name="reassign_user">';
         foreach($all_logins as $login) {
-                if(!in_array($login->ID, $userids)) {
+                if($login->ID == $current_user->id || !in_array($login->ID, $userids)) {
                         $user_dropdown .= "<option value=\"{$login->ID}\">{$login->user_login}</option>";
                 }
         }
         $user_dropdown .= '</select>';
         ?>
         </ul>
+        <?php if($go_delete) : ?>
         <p><?php _e('What should be done with posts and links owned by this user?'); ?></p>
         <ul style="list-style:none;">
                 <li><label><input type="radio" id="delete_option0" name="delete_option" value="delete" checked="checked" />
@@ -102 +121 @@
         </ul>
         <input type="hidden" name="action" value="dodelete" />
         <p class="submit"><input type="submit" name="submit" value="<?php _e('Confirm Deletion'); ?>" /></p>
+        <?php else : ?>
+        <p><?php _e('There are no valid users selected for deletion.'); ?></p>
+        <?php endif; ?>
 </div>
 </form>
 <?php
@@ -151 +173 @@
                         <div id="message" class="updated fade"><p><?php _e('Changed roles.'); ?></p></div>
                 <?php
                         break;
+                case 'err_admin_role':
+                ?>
+                        <div id="message" class="error"><p><?php _e('The current user\'s role must have user editing capabilities.'); ?></p></div>
+                        <div id="message" class="updated fade"><p><?php _e('Other user roles have been changed.'); ?></p></div>
+                <?php
+                        break;
+                case 'err_admin_del':
+                ?>
+                        <div id="message" class="error"><p><?php _e('You can\'t delete the current user.'); ?></p></div>
+                        <div id="message" class="updated fade"><p><?php _e('Other users have been deleted.'); ?></p></div>
+                <?php
+                        break;
                 }
         endif; 
         if ( isset($errors) ) : ?>