Changeset 11761 for trunk/wp-admin/plugins.php

Timestamp:

08/01/2009 09:12:17 PM (17 years ago)

Author:

ryan

Message:

Add some CYA cap checks.

File:

• trunk/wp-admin/plugins.php (modified) (6 diffs)

trunk/wp-admin/plugins.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('admin.php');
+
+if ( ! current_user_can('activate_plugins') )
+        wp_die(__('You do not have sufficient permissions to manage plugins for this blog.'));
 
 if ( isset($_POST['clear-recent-list']) )
@@ -38 +41 @@
         switch ( $action ) {
                 case 'activate':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+
                         check_admin_referer('activate-plugin_' . $plugin);
 
@@ -54 +60 @@
                         break;
                 case 'activate-selected':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+                        
                         check_admin_referer('bulk-manage-plugins');
 
@@ -76 +85 @@
                         break;
                 case 'error_scrape':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
+
                         check_admin_referer('plugin-activation-error_' . $plugin);
 
@@ -89 +101 @@
                         break;
                 case 'deactivate':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
+
                         check_admin_referer('deactivate-plugin_' . $plugin);
                         deactivate_plugins($plugin);
@@ -96 +111 @@
                         break;
                 case 'deactivate-selected':
+                        if ( ! current_user_can('activate_plugins') )
+                                wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
+
                         check_admin_referer('bulk-manage-plugins');