Changeset 11761 for trunk/wp-admin/plugins.php

Timestamp:

08/01/2009 09:12:17 PM (15 years ago)

Author:

ryan

Message:

Add some CYA cap checks.

File:

• trunk/wp-admin/plugins.php (modified) (6 diffs)

trunk/wp-admin/plugins.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('activate_plugins') )
+    wp_die(__('You do not have sufficient permissions to manage plugins for this blog.'));
 
 if ( isset($_POST['clear-recent-list']) )
@@ -38 +41 @@
     switch ( $action ) {
         case 'activate':
+            if ( ! current_user_can('activate_plugins') )
+                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+
             check_admin_referer('activate-plugin_' . $plugin);
 
@@ -54 +60 @@
             break;
         case 'activate-selected':
+            if ( ! current_user_can('activate_plugins') )
+                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+            
             check_admin_referer('bulk-manage-plugins');
 
@@ -76 +85 @@
             break;
         case 'error_scrape':
+            if ( ! current_user_can('activate_plugins') )
+                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+
             check_admin_referer('plugin-activation-error_' . $plugin);
 
@@ -89 +101 @@
             break;
         case 'deactivate':
+            if ( ! current_user_can('activate_plugins') )
+                wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
+
             check_admin_referer('deactivate-plugin_' . $plugin);
             deactivate_plugins($plugin);
@@ -96 +111 @@
             break;
         case 'deactivate-selected':
+            if ( ! current_user_can('activate_plugins') )
+                wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
+
             check_admin_referer('bulk-manage-plugins');