Ticket #2775: user_caps.diff

wp-includes/version.php

@@ -2 +2 @@
 
 // This just holds the version number, in a separate file so we can bump it without cluttering the SVN
 
-$wp_version = '2.1-alpha1';
-$wp_db_version = 3809;
+$wp_version = '2.1-alpha2';
+$wp_db_version = 3845;
 
 ?>

wp-includes/capabilities.php

@@ -272 +272 @@
         $caps = array();
 
         switch ($cap) {
+        case 'delete_user':
+                $caps[] = 'delete_users';
+                break;
+        case 'edit_user':
+                $caps[] = 'edit_users';
+                break;
         case 'delete_post':
                 $author_data = get_userdata($user_id);
                 //echo "post ID: {$args[0]}<br/>";

wp-admin/users.php

@@ -23 +23 @@
         $userids = $_POST['users'];
         $update = 'promote';
         foreach($userids as $id) {
+                if ( ! current_user_can('edit_user', $id) )
+                        die(__('You can’t edit that user.'));
                 // The new role of the current user must also have edit_users caps
                 if($id == $current_user->id && !$wp_roles->role_objects[$_POST['new_role']]->has_cap('edit_users')) {
                         $update = 'err_admin_role';
@@ -45 +47 @@
                 header('Location: users.php');
         }
 
-        if ( !current_user_can('edit_users') )
+        if ( !current_user_can('delete_users') )
                 die(__('You can’t delete users.'));
 
         $userids = $_POST['users'];
 
         $update = 'del';
         foreach ($userids as $id) {
+                if ( ! current_user_can('delete_user', $id) )
+                        die(__('You can’t delete that user.'));
+ 
                 if($id == $current_user->id) {
                         $update = 'err_admin_del';
                         continue;
@@ -78 +83 @@
                 header('Location: users.php');
         }
 
-        if ( !current_user_can('edit_users') )
+        if ( !current_user_can('delete_users') )
                 $error = new WP_Error('edit_users', __('You can’t delete users.'));
 
         $userids = $_POST['users'];
@@ -134 +139 @@
 case 'adduser':
         check_admin_referer('add-user');
 
+        if ( ! current_user_can('create_users') )
+                die(__('You can’t create users.'));
+
         $user_id = add_user();
         if ( is_wp_error( $user_id ) )
                 $errors = $user_id;

wp-admin/upgrade-functions.php

@@ -492 +492 @@
                 }
         }
 
-        if ( $wp_current_db_version < 3767 ) {
+        if ( $wp_current_db_version < 3845 ) {
                 populate_roles_210();
         }
 

wp-admin/admin-functions.php

@@ -738 +738 @@
                 <td><a href='$url' title='website: $url'>$short_url</a></td>";
         $r .= "\n\t\t<td align='center'>$numposts</td>";
         $r .= "\n\t\t<td>";
-        if (current_user_can('edit_users'))
+        if ( current_user_can('edit_user', $user_object->ID) )
                 $r .= "<a href='user-edit.php?user_id=$user_object->ID' class='edit'>".__('Edit')."</a>";
         $r .= "</td>\n\t</tr>";
         return $r;

wp-admin/user-edit.php

@@ -34 +34 @@
 
 check_admin_referer('update-user_' . $user_id);
 
-if (!current_user_can('edit_users'))
+if ( !current_user_can('edit_user', $user_id) )
         $errors = new WP_Error('head', __('You do not have permission to edit this user.'));
 else
         $errors = edit_user($user_id);
@@ -49 +49 @@
 
 $profileuser = new WP_User($user_id);
 
-if (!current_user_can('edit_users'))
+if ( !current_user_can('edit_user', $user_id) )
         if ( !is_wp_error( $errors ) )
                 $errors = new WP_Error('head', __('You do not have permission to edit this user.'));
 ?>

wp-admin/upgrade-schema.php

@@ -364 +364 @@
                 $role->add_cap('read_private_pages');
         }
 
+        $role = get_role('administrator');
+        if ( ! empty($role) ) {
+                $role->add_cap('delete_users');
+                $role->add_cap('create_users');
+        }
+
         $role = get_role('author');
         if ( ! empty($role) ) {
                 $role->add_cap('delete_posts');