Ticket #31021: 31021.diff

src/wp-admin/custom-background.php

@@ -61 +61 @@
          * @since 3.0.0
          */
         public function init() {
-                $page = add_theme_page( __( 'Background' ), __( 'Background' ), 'edit_theme_options', 'custom-background', array( $this, 'admin_page' ) );
+                $page = add_theme_page( __( 'Background' ), __( 'Background' ), 'manage_custom_background', 'custom-background', array( $this, 'admin_page' ) );
                 if ( ! $page ) {
                         return;
                 }
@@ -416 +416 @@
         public function ajax_background_add() {
                 check_ajax_referer( 'background-add', 'nonce' );
 
-                if ( ! current_user_can( 'edit_theme_options' ) ) {
+                if ( ! current_user_can( 'manage_custom_background' ) ) {
                         wp_send_json_error();
                 }
 
@@ -454 +454 @@
          * @deprecated 3.5.0
          */
         public function wp_set_background_image() {
-                if ( ! current_user_can('edit_theme_options') || ! isset( $_POST['attachment_id'] ) ) exit;
+                if ( ! current_user_can( 'manage_custom_background' ) || ! isset( $_POST['attachment_id'] ) ) exit;
                 $attachment_id = absint($_POST['attachment_id']);
                 /** This filter is documented in wp-admin/includes/media.php */
                 $sizes = array_keys(apply_filters( 'image_size_names_choose', array('thumbnail' => __('Thumbnail'), 'medium' => __('Medium'), 'large' => __('Large'), 'full' => __('Full Size')) ));

src/wp-admin/custom-header.php

@@ -70 +70 @@
          * @since 2.1.0
          */
         public function init() {
-                $page = add_theme_page( __( 'Header' ), __( 'Header' ), 'edit_theme_options', 'custom-header', array( $this, 'admin_page' ) );
+                $page = add_theme_page( __( 'Header' ), __( 'Header' ), 'manage_custom_header', 'custom-header', array( $this, 'admin_page' ) );
                 if ( ! $page ) {
                         return;
                 }
@@ -184 +184 @@
          * @since 2.6.0
          */
         public function take_action() {
-                if ( ! current_user_can('edit_theme_options') )
+                if ( ! current_user_can( 'manage_custom_header' ) ) {
                         return;
+                }
 
-                if ( empty( $_POST ) )
+                if ( empty( $_POST ) ) {
                         return;
+                }
 
                 $this->updated = true;
 
@@ -916 +918 @@
          * @since 2.1.0
          */
         public function admin_page() {
-                if ( ! current_user_can('edit_theme_options') )
-                        wp_die(__('You do not have permission to customize headers.'));
+                if ( ! current_user_can( 'manage_custom_header' ) ) {
+                        wp_die( __( 'You do not have permission to customize headers.' ) );
+                }
                 $step = $this->step();
                 if ( 2 == $step )
                         $this->step_2();
@@ -1147 +1150 @@
         public function ajax_header_crop() {
                 check_ajax_referer( 'image_editor-' . $_POST['id'], 'nonce' );
 
-                if ( ! current_user_can( 'edit_theme_options' ) ) {
+                if ( ! current_user_can( 'manage_custom_header' ) ) {
                         wp_send_json_error();
                 }
 
@@ -1204 +1207 @@
         public function ajax_header_add() {
                 check_ajax_referer( 'header-add', 'nonce' );
 
-                if ( ! current_user_can( 'edit_theme_options' ) ) {
+                if ( ! current_user_can( 'manage_custom_header' ) ) {
                         wp_send_json_error();
                 }
 
@@ -1230 +1233 @@
         public function ajax_header_remove() {
                 check_ajax_referer( 'header-remove', 'nonce' );
 
-                if ( ! current_user_can( 'edit_theme_options' ) ) {
+                if ( ! current_user_can( 'manage_custom_header' ) ) {
                         wp_send_json_error();
                 }
 

src/wp-admin/includes/ajax-actions.php

@@ -1065 +1065 @@
 function wp_ajax_add_menu_item() {
         check_ajax_referer( 'add-menu_item', 'menu-settings-column-nonce' );
 
-        if ( ! current_user_can( 'edit_theme_options' ) )
+        if ( ! current_user_can( 'manage_menus' ) ) {
                 wp_die( -1 );
+        }
 
         require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
 
@@ -1342 +1343 @@
  * @since 3.1.0
  */
 function wp_ajax_menu_get_metabox() {
-        if ( ! current_user_can( 'edit_theme_options' ) )
+        if ( ! current_user_can( 'manage_menus' ) ) {
                 wp_die( -1 );
+        }
 
         require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
 
@@ -1416 +1418 @@
  * @since 3.1.0
  */
 function wp_ajax_menu_locations_save() {
-        if ( ! current_user_can( 'edit_theme_options' ) )
+        if ( ! current_user_can( 'manage_menus' ) ) {
                 wp_die( -1 );
+        }
         check_ajax_referer( 'add-menu_item', 'menu-settings-column-nonce' );
         if ( ! isset( $_POST['menu-locations'] ) )
                 wp_die( 0 );
@@ -1461 +1464 @@
  * @since 3.1.0
  */
 function wp_ajax_menu_quick_search() {
-        if ( ! current_user_can( 'edit_theme_options' ) )
+        if ( ! current_user_can( 'manage_menus' ) ) {
                 wp_die( -1 );
+        }
 
         require_once ABSPATH . 'wp-admin/includes/nav-menu.php';
 
@@ -1700 +1704 @@
 function wp_ajax_widgets_order() {
         check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
 
-        if ( !current_user_can('edit_theme_options') )
+        if ( ! current_user_can( 'manage_widgets' ) ) {
                 wp_die( -1 );
+        }
 
         unset( $_POST['savewidgets'], $_POST['action'] );
 
@@ -1738 +1743 @@
 
         check_ajax_referer( 'save-sidebar-widgets', 'savewidgets' );
 
-        if ( !current_user_can('edit_theme_options') || !isset($_POST['id_base']) )
+        if ( ! current_user_can( 'manage_widgets' ) || ! isset( $_POST['id_base'] ) ) {
                 wp_die( -1 );
+        }
 
         unset( $_POST['savewidgets'], $_POST['action'] );
 

src/wp-admin/includes/dashboard.php

@@ -1306 +1306 @@
         <div class="welcome-panel-column welcome-panel-last">
                 <h4><?php _e( 'More Actions' ); ?></h4>
                 <ul>
-                <?php if ( current_theme_supports( 'widgets' ) || current_theme_supports( 'menus' ) ) : ?>
+                <?php
+                $show_widgets = ( current_theme_supports( 'widgets' ) && current_user_can( 'manage_widgets' ) );
+                $show_menus = ( current_theme_supports( 'menus' ) && current_user_can( 'manage_menus' ) );
+                ?>
+                <?php if ( $show_widgets || $show_menus ) : ?>
                         <li><div class="welcome-icon welcome-widgets-menus"><?php
-                                if ( current_theme_supports( 'widgets' ) && current_theme_supports( 'menus' ) ) {
+                                if ( $show_widgets && $show_menus ) {
                                         printf( __( 'Manage <a href="%1$s">widgets</a> or <a href="%2$s">menus</a>' ),
                                                 admin_url( 'widgets.php' ), admin_url( 'nav-menus.php' ) );
-                                } elseif ( current_theme_supports( 'widgets' ) ) {
+                                } elseif ( $show_widgets ) {
                                         echo '<a href="' . admin_url( 'widgets.php' ) . '">' . __( 'Manage widgets' ) . '</a>';
                                 } else {
                                         echo '<a href="' . admin_url( 'nav-menus.php' ) . '">' . __( 'Manage menus' ) . '</a>';

src/wp-admin/includes/menu.php

@@ -93 +93 @@
 foreach ( $menu as $id => $data ) {
         if ( empty($submenu[$data[2]]) )
                 continue;
-        $subs = $submenu[$data[2]];
-        $first_sub = array_shift($subs);
+        $subs = $submenu[ $data[2] ];
+        $first_sub = array_shift( $subs );
         $old_parent = $data[2];
         $new_parent = $first_sub[2];
         /*
@@ -102 +102 @@
          * make the first submenu the new parent.
          */
         if ( $new_parent != $old_parent ) {
-                $_wp_real_parent_file[$old_parent] = $new_parent;
-                $menu[$id][2] = $new_parent;
+                $_wp_real_parent_file[ $old_parent ] = $new_parent;
+                $menu[ $id ][1] = $first_sub[1]; // capability
+                $menu[ $id ][2] = $first_sub[2]; // location
+                if ( empty( $subs ) ) {
+                        $menu[ $id ][0] = $first_sub[0]; // label
+                }
 
                 foreach ($submenu[$old_parent] as $index => $data) {
                         $submenu[$new_parent][$index] = $submenu[$old_parent][$index];

src/wp-admin/includes/template.php

@@ -2017 +2017 @@
         }
 
         public static function pointer_wp390_widgets() {
-                if ( ! current_theme_supports( 'widgets' ) ) {
+                if ( ! current_theme_supports( 'widgets' ) || ! current_user_can( 'manage_widgets' ) ) {
                         return;
                 }
 

src/wp-admin/menu.php

@@ -154 +154 @@
         $submenu['themes.php'][6] = array( __( 'Customize' ), 'customize', $customize_url, '', 'hide-if-no-customize' );
 
         if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) {
-                $submenu['themes.php'][10] = array(__( 'Menus' ), 'edit_theme_options', 'nav-menus.php');
+                $submenu['themes.php'][10] = array(__( 'Menus' ), 'manage_menus', 'nav-menus.php');
         }
 
-        if ( current_theme_supports( 'custom-header' ) && current_user_can( 'customize') ) {
+        if ( current_theme_supports( 'custom-header' ) && current_user_can( 'customize' ) && current_user_can( 'manage_custom_header' ) ) {
                 $customize_header_url = add_query_arg( 'autofocus[control]', 'header_image', $customize_url );
                 $submenu['themes.php'][15] = array( __( 'Header' ), $appearance_cap, $customize_header_url, '', 'hide-if-no-customize' );
         }
 
-        if ( current_theme_supports( 'custom-background' ) && current_user_can( 'customize') ) {
+        if ( current_theme_supports( 'custom-background' ) && current_user_can( 'customize') && current_user_can( 'manage_custom_background' ) ) {
                 $customize_background_url = add_query_arg( 'autofocus[control]', 'background_image', $customize_url );
                 $submenu['themes.php'][20] = array( __( 'Background' ), $appearance_cap, $customize_background_url, '', 'hide-if-no-customize' );
         }

src/wp-admin/nav-menus.php

@@ -15 +15 @@
 // Load all the nav menu interface functions
 require_once( ABSPATH . 'wp-admin/includes/nav-menu.php' );
 
-if ( ! current_theme_supports( 'menus' ) && ! current_theme_supports( 'widgets' ) )
+if ( ! current_theme_supports( 'menus' ) && ! current_theme_supports( 'widgets' ) ) {
         wp_die( __( 'Your theme does not support navigation menus or widgets.' ) );
+}
 
 // Permissions Check
-if ( ! current_user_can('edit_theme_options') )
+if ( ! current_user_can( 'manage_menus' ) ) {
         wp_die( __( 'Cheatin’ uh?' ), 403 );
+}
+if ( ! current_theme_supports( 'menus' ) && ! current_user_can( 'manage_widgets' ) ) {
+        wp_die( __( 'Your theme does not support navigation menus and you do not have permission to manage widgets.' ) );
+}
 
 wp_enqueue_script( 'nav-menu' );
 

src/wp-admin/widgets.php

@@ -12 +12 @@
 /** WordPress Administration Widgets API */
 require_once(ABSPATH . 'wp-admin/includes/widgets.php');
 
-if ( ! current_user_can('edit_theme_options') )
+if ( ! current_user_can( 'manage_widgets' ) ) {
         wp_die( __( 'Cheatin’ uh?' ), 403 );
+}
 
 $widgets_access = get_user_setting( 'widgets_access' );
 if ( isset($_GET['widgets-access']) ) {

src/wp-includes/admin-bar.php

@@ -657 +657 @@
 function wp_admin_bar_appearance_menu( $wp_admin_bar ) {
         $wp_admin_bar->add_group( array( 'parent' => 'site-name', 'id' => 'appearance' ) );
 
-        if ( current_user_can( 'switch_themes' ) || current_user_can( 'edit_theme_options' ) )
-                $wp_admin_bar->add_menu( array( 'parent' => 'appearance', 'id' => 'themes', 'title' => __('Themes'), 'href' => admin_url('themes.php') ) );
-
-        if ( ! current_user_can( 'edit_theme_options' ) )
-                return;
+        if ( current_user_can( 'switch_themes' ) || current_user_can( 'edit_theme_options' ) ) {
+                $wp_admin_bar->add_menu( array( 'parent' => 'appearance', 'id' => 'themes', 'title' => __( 'Themes' ), 'href' => admin_url( 'themes.php' ) ) );
+        }
 
         $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
         $customize_url = add_query_arg( 'url', urlencode( $current_url ), wp_customize_url() );
@@ -678 +676 @@
                 add_action( 'wp_before_admin_bar_render', 'wp_customize_support_script' );
         }
 
-        if ( current_theme_supports( 'widgets' )  ) {
+        if ( current_user_can( 'manage_widgets' ) && current_theme_supports( 'widgets' ) ) {
                 $wp_admin_bar->add_menu( array( 
                         'parent' => 'appearance', 
                         'id'     => 'widgets', 
@@ -702 +700 @@
                 }
         }
 
-        if ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) )
-                $wp_admin_bar->add_menu( array( 'parent' => 'appearance', 'id' => 'menus', 'title' => __('Menus'), 'href' => admin_url('nav-menus.php') ) );
+        if ( current_user_can( 'manage_menus' ) && ( current_theme_supports( 'menus' ) || current_theme_supports( 'widgets' ) ) ) {
+                $wp_admin_bar->add_menu( array( 'parent' => 'appearance', 'id' => 'menus', 'title' => __( 'Menus' ), 'href' => admin_url( 'nav-menus.php' ) ) );
+        }
 
-        if ( current_theme_supports( 'custom-background' ) ) {
+        if ( current_user_can( 'manage_custom_background' ) && current_theme_supports( 'custom-background' ) ) {
                 $wp_admin_bar->add_menu( array(
                         'parent' => 'appearance',
                         'id'     => 'background',
@@ -729 +728 @@
                 }
         }
 
-        if ( current_theme_supports( 'custom-header' ) ) {
+        if ( current_user_can( 'manage_custom_header' ) && current_theme_supports( 'custom-header' ) ) {
                 $wp_admin_bar->add_menu( array(
                         'parent' => 'appearance',
                         'id'     => 'header',

src/wp-includes/capabilities.php

@@ -1335 +1335 @@
         case 'customize' :
                 $caps[] = 'edit_theme_options';
                 break;
+        case 'manage_menus' :
+                $caps[] = 'edit_theme_options';
+                break;
+        case 'manage_widgets' :
+                $caps[] = 'edit_theme_options';
+                break;
+        case 'manage_custom_header' :
+                $caps[] = 'edit_theme_options';
+                break;
+        case 'manage_custom_background' :
+                $caps[] = 'edit_theme_options';
+                break;
         default:
                 // Handle meta capabilities for custom post types.
                 $post_type_meta_caps = _post_type_meta_capabilities();

src/wp-includes/class-wp-customize-manager.php

@@ -1026 +1026 @@
                 $this->add_section( 'colors', array(
                         'title'          => __( 'Colors' ),
                         'priority'       => 40,
+                        'capability'     => '', // set to empty so that capability will be derived from contained controls (and their settings)
                 ) );
 
                 $this->add_setting( 'header_textcolor', array(
                         'theme_supports' => array( 'custom-header', 'header-text' ),
                         'default'        => get_theme_support( 'custom-header', 'default-text-color' ),
+                        'capability'     => 'manage_custom_header',
 
                         'sanitize_callback'    => array( $this, '_sanitize_header_textcolor' ),
                         'sanitize_js_callback' => 'maybe_hash_hex_color',
@@ -1055 +1057 @@
                 $this->add_setting( 'background_color', array(
                         'default'        => get_theme_support( 'custom-background', 'default-color' ),
                         'theme_supports' => 'custom-background',
+                        'capability'     => 'manage_custom_background',
 
                         'sanitize_callback'    => 'sanitize_hex_color_no_hash',
                         'sanitize_js_callback' => 'maybe_hash_hex_color',
@@ -1072 +1075 @@
                         'title'          => __( 'Header Image' ),
                         'theme_supports' => 'custom-header',
                         'priority'       => 60,
+                        'capability'     => '', // set to empty so that capability will be derived from contained controls (and their settings)
                 ) );
 
                 $this->add_setting( new WP_Customize_Filter_Setting( $this, 'header_image', array(
                         'default'        => get_theme_support( 'custom-header', 'default-image' ),
                         'theme_supports' => 'custom-header',
+                        'capability'     => 'manage_custom_header',
                 ) ) );
 
                 $this->add_setting( new WP_Customize_Header_Image_Setting( $this, 'header_image_data', array(
                         // 'default'        => get_theme_support( 'custom-header', 'default-image' ),
                         'theme_supports' => 'custom-header',
+                        'capability'     => 'manage_custom_header',
                 ) ) );
 
                 $this->add_control( new WP_Customize_Header_Image_Control( $this ) );
@@ -1092 +1098 @@
                         'title'          => __( 'Background Image' ),
                         'theme_supports' => 'custom-background',
                         'priority'       => 80,
+                        'capability'     => '', // set to empty so that capability will be derived from contained controls (and their settings)
                 ) );
 
                 $this->add_setting( 'background_image', array(
                         'default'        => get_theme_support( 'custom-background', 'default-image' ),
                         'theme_supports' => 'custom-background',
+                        'capability'     => 'manage_custom_background',
                 ) );
 
                 $this->add_setting( new WP_Customize_Background_Image_Setting( $this, 'background_image_thumb', array(
                         'theme_supports' => 'custom-background',
+                        'capability'     => 'manage_custom_background',
                 ) ) );
 
                 $this->add_control( new WP_Customize_Background_Image_Control( $this ) );
@@ -1108 +1117 @@
                 $this->add_setting( 'background_repeat', array(
                         'default'        => get_theme_support( 'custom-background', 'default-repeat' ),
                         'theme_supports' => 'custom-background',
+                        'capability'     => 'manage_custom_background',
                 ) );
 
                 $this->add_control( 'background_repeat', array(
@@ -1125 +1135 @@
                 $this->add_setting( 'background_position_x', array(
                         'default'        => get_theme_support( 'custom-background', 'default-position-x' ),
                         'theme_supports' => 'custom-background',
+                        'capability'     => 'manage_custom_background',
                 ) );
 
                 $this->add_control( 'background_position_x', array(
                         'label'      => __( 'Background Position' ),
                         'section'    => 'background_image',
+                        'capability' => 'manage_custom_background',
                         'type'       => 'radio',
                         'choices'    => array(
                                 'left'       => __('Left'),
@@ -1141 +1153 @@
                 $this->add_setting( 'background_attachment', array(
                         'default'        => get_theme_support( 'custom-background', 'default-attachment' ),
                         'theme_supports' => 'custom-background',
+                        'capability'     => 'manage_custom_background',
                 ) );
 
                 $this->add_control( 'background_attachment', array(
@@ -1171 +1184 @@
                         'title'          => __( 'Navigation' ),
                         'theme_supports' => 'menus',
                         'priority'       => 100,
-                        'description'    => sprintf( _n('Your theme supports %s menu. Select which menu you would like to use.', 'Your theme supports %s menus. Select which menu appears in each location.', $num_locations ), number_format_i18n( $num_locations ) ) . "\n\n" . __('You can edit your menu content on the Menus screen in the Appearance section.'),
+                        'description'    => sprintf( _n( 'Your theme supports %s menu. Select which menu you would like to use.', 'Your theme supports %s menus. Select which menu appears in each location.', $num_locations ), number_format_i18n( $num_locations ) ) . "\n\n" . __( 'You can edit your menu content on the Menus screen in the Appearance section.' ),
+                        'capability'     => 'manage_menus',
                 ) );
 
                 if ( $menus ) {
@@ -1186 +1200 @@
                                 $this->add_setting( $menu_setting_id, array(
                                         'sanitize_callback' => 'absint',
                                         'theme_supports'    => 'menus',
+                                        'capability'        => 'manage_menus',
                                 ) );
 
                                 $this->add_control( $menu_setting_id, array(

src/wp-includes/class-wp-customize-widgets.php

@@ -437 +437 @@
                         'title'       => __( 'Widgets' ),
                         'description' => __( 'Widgets are independent sections of content that can be placed into widgetized areas provided by your theme (commonly called sidebars).' ),
                         'priority'    => 110,
+                        'capability'  => 'manage_widgets',
                 ) );
 
                 foreach ( $sidebars_widgets as $sidebar_id => $sidebar_widget_ids ) {
@@ -469 +470 @@
                                                 'priority' => array_search( $sidebar_id, array_keys( $wp_registered_sidebars ) ),
                                                 'panel' => 'widgets',
                                                 'sidebar_id' => $sidebar_id,
+                                                'capability' => 'manage_widgets',
                                         );
 
                                         /**
@@ -800 +802 @@
         public function get_setting_args( $id, $overrides = array() ) {
                 $args = array(
                         'type'       => 'option',
-                        'capability' => 'edit_theme_options',
+                        'capability' => 'manage_widgets',
                         'transport'  => 'refresh',
                         'default'    => array(),
                 );
@@ -1379 +1381 @@
 
                 check_ajax_referer( 'update-widget', 'nonce' );
 
-                if ( ! current_user_can( 'edit_theme_options' ) ) {
+                if ( ! current_user_can( 'manage_widgets' ) ) {
                         wp_die( -1 );
                 }
 

src/wp-includes/default-widgets.php

@@ -1348 +1348 @@
                 $menus = wp_get_nav_menus();
 
                 // If no menus exists, direct the user to go and create some.
-                if ( !$menus ) {
-                        echo '<p>'. sprintf( __('No menus have been created yet. <a href="%s">Create some</a>.'), admin_url('nav-menus.php') ) .'</p>';
+                if ( ! $menus ) {
+                        if ( current_user_can( 'manage_menus' ) ) {
+                                echo '<p>'. sprintf( __( 'No menus have been created yet. <a href="%s">Create some</a>.' ), admin_url( 'nav-menus.php' ) ) . '</p>';
+                        } else {
+                                echo '<p>' . __( 'No menus have been created yet, and you do not have permission to create them.' ) . '</p>';
+                        }
                         return;
                 }
                 ?>

src/wp-includes/functions.php

@@ -3255 +3255 @@
         if ( ! current_theme_supports( 'widgets' ) )
                 return;
 
-        $submenu['themes.php'][7] = array( __( 'Widgets' ), 'edit_theme_options', 'widgets.php' );
+        $submenu['themes.php'][7] = array( __( 'Widgets' ), 'manage_widgets', 'widgets.php' );
         ksort( $submenu['themes.php'], SORT_NUMERIC );
 }