Changeset 13301 for trunk/wp-admin/ms-edit.php

Timestamp:

02/22/2010 06:41:38 PM (17 years ago)

Author:

wpmuguru

Message:

multisite UX, see #11644, add manage_ caps for super_admin, fixes #11803

File:

• trunk/wp-admin/ms-edit.php (modified) (15 diffs)

trunk/wp-admin/ms-edit.php

@@ -4 +4 @@
 if ( !is_multisite() )
         wp_die( __('Multisite support is not enabled.') );
-
-if ( !is_super_admin() )
-        wp_die( __('You do not have permission to access this page.') );
 
 do_action('wpmuadminedit', '');
@@ -21 +18 @@
         case "siteoptions":
                 check_admin_referer('siteoptions');
+                if ( ! current_user_can( 'manage_network_options' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 if ( empty( $_POST ) )
                         wp_die( __("You probably need to go back to the <a href='ms-options.php'>options page</a>") );
@@ -138 +138 @@
                 check_admin_referer('add-blog');
 
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 if ( is_array( $_POST[ 'blog' ] ) == false )
                         wp_die( "Can't create an empty blog." );
@@ -188 +191 @@
         case "updateblog":
                 check_admin_referer('editblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 if ( empty( $_POST ) )
                         wp_die( __('You probably need to go back to the <a href="ms-sites.php">sites page</a>') );
@@ -289 +295 @@
         case "deleteblog":
                 check_admin_referer('deleteblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 if ( $id != '0' && $id != $current_site->blog_id )
                         wpmu_delete_blog( $id, true );
@@ -298 +307 @@
         case "allblogs":
                 check_admin_referer('allblogs');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 foreach ( (array) $_POST[ 'allblogs' ] as $key => $val ) {
                         if ( $val != '0' && $val != $current_site->blog_id ) {
@@ -321 +333 @@
         case "archiveblog":
                 check_admin_referer('archiveblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 update_blog_status( $id, "archived", '1' );
                 do_action( "archive_blog", $id );
@@ -329 +344 @@
         case "unarchiveblog":
                 check_admin_referer('unarchiveblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 do_action( "unarchive_blog", $id );
                 update_blog_status( $id, "archived", '0' );
@@ -337 +355 @@
         case "activateblog":
                 check_admin_referer('activateblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 update_blog_status( $id, "deleted", '0' );
                 do_action( "activate_blog", $id );
@@ -345 +366 @@
         case "deactivateblog":
                 check_admin_referer('deactivateblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 do_action( "deactivate_blog", $id );
                 update_blog_status( $id, "deleted", '1' );
@@ -353 +377 @@
         case "unspamblog":
                 check_admin_referer('unspamblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 update_blog_status( $id, "spam", '0' );
                 wp_redirect( add_query_arg( array('updated' => 'true', 'action' => 'unspam'), $_POST['ref'] ) );
@@ -360 +387 @@
         case "spamblog":
                 check_admin_referer('spamblog');
+                if ( ! current_user_can( 'manage_sites' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 update_blog_status( $id, "spam", '1' );
                 wp_redirect( add_query_arg( array('updated' => 'true', 'action' => 'spam'), $_POST['ref'] ) );
@@ -382 +412 @@
         // Themes
     case "updatethemes":
+        if ( ! current_user_can( 'manage_network_themes' ) )
+                wp_die( __('You do not have permission to access this page.') );
+
         if ( is_array( $_POST['theme'] ) ) {
                         $themes = get_themes();
@@ -439 +472 @@
         case "allusers":
                 check_admin_referer('allusers');
+                if ( ! current_user_can( 'manage_network_users' ) )
+                        wp_die( __('You do not have permission to access this page.') );
+
                 if ( isset($_POST['alluser_delete']) ) {
                         require_once('admin-header.php');
@@ -488 +524 @@
         case "adduser":
                 check_admin_referer('add-user');
+                if ( ! current_user_can( 'manage_network_users' ) )
+                        wp_die( __('You do not have permission to access this page.') );
 
                 if ( is_array( $_POST[ 'user' ] ) == false )