Changeset 11761

Timestamp:

08/01/2009 09:12:17 PM (17 years ago)

Author:

ryan

Message:

Add some CYA cap checks.

Location:

trunk

Files:

• wp-admin/options-discussion.php (modified) (1 diff)
• wp-admin/options-general.php (modified) (1 diff)
• wp-admin/options-media.php (modified) (1 diff)
• wp-admin/options-misc.php (modified) (1 diff)
• wp-admin/options-permalink.php (modified) (1 diff)
• wp-admin/options-privacy.php (modified) (1 diff)
• wp-admin/options-reading.php (modified) (1 diff)
• wp-admin/options-writing.php (modified) (1 diff)
• wp-admin/plugins.php (modified) (6 diffs)
• wp-admin/themes.php (modified) (1 diff)
• wp-includes/vars.php (modified) (1 diff)

trunk/wp-admin/options-discussion.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('Discussion Settings');

trunk/wp-admin/options-general.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('./admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('General Settings');

trunk/wp-admin/options-media.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('Media Settings');

trunk/wp-admin/options-misc.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('Miscellaneous Settings');

trunk/wp-admin/options-permalink.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('Permalink Settings');

trunk/wp-admin/options-privacy.php

@@ -9 +9 @@
 /** Load WordPress Administration Bootstrap */
 require_once('./admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('Privacy Settings');

trunk/wp-admin/options-reading.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('Reading Settings');

trunk/wp-admin/options-writing.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('manage_options') )
+        wp_die(__('You do not have sufficient permissions to manage options for this blog.'));
 
 $title = __('Writing Settings');

trunk/wp-admin/plugins.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('activate_plugins') )
+        wp_die(__('You do not have sufficient permissions to manage plugins for this blog.'));
 
 if ( isset($_POST['clear-recent-list']) )
@@ -38 +41 @@
         switch ( $action ) {
                 case 'activate':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+
                         check_admin_referer('activate-plugin_' . $plugin);
 
@@ -54 +60 @@
                         break;
                 case 'activate-selected':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+                        
                         check_admin_referer('bulk-manage-plugins');
 
@@ -76 +85 @@
                         break;
                 case 'error_scrape':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+
                         check_admin_referer('plugin-activation-error_' . $plugin);
 
@@ -89 +101 @@
                         break;
                 case 'deactivate':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
+
                         check_admin_referer('deactivate-plugin_' . $plugin);
                         deactivate_plugins($plugin);
@@ -96 +111 @@
                         break;
                 case 'deactivate-selected':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
+
                         check_admin_referer('bulk-manage-plugins');
 

trunk/wp-admin/themes.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( !current_user_can('switch_themes') )
+        wp_die( __( 'Cheatin’ uh?' ) );
 
 if ( isset($_GET['action']) ) {

trunk/wp-includes/vars.php

@@ -18 +18 @@
         preg_match('#/wp-admin/?(.*?)$#i', $PHP_SELF, $self_matches);
         $pagenow = $self_matches[1];
+        $pagenow = trim($pagenow, '/');
         $pagenow = preg_replace('#\?.*?$#', '', $pagenow);
         if ( '' === $pagenow || 'index' === $pagenow || 'index.php' === $pagenow ) {