Changeset 14189

Timestamp:

04/22/2010 07:48:13 PM (15 years ago)

Author:

josephscott

Message:

New 'list_users' cap to provide more controls over listing users vs. editing
users.

Apply this new cap to the 'Authors & Users' menu item and 'Users' page in
wp-admin.

Bump db version to 14139 to pick up the new cap.

See #13074

Location:

trunk

Files:

• wp-admin/includes/schema.php (modified) (1 diff)
• wp-admin/includes/template.php (modified) (2 diffs)
• wp-admin/includes/upgrade.php (modified) (3 diffs)
• wp-admin/menu.php (modified) (1 diff)
• wp-admin/users.php (modified) (1 diff)
• wp-includes/capabilities.php (modified) (1 diff)
• wp-includes/version.php (modified) (1 diff)

trunk/wp-admin/includes/schema.php

@@ -608 +608 @@
     if ( !empty( $role ) ) {
         $role->add_cap( 'update_core' );
+        $role->add_cap( 'list_users' );
         $role->add_cap( 'remove_users' );
         $role->add_cap( 'add_users' );

trunk/wp-admin/includes/template.php

@@ -1813 +1813 @@
     $checkbox = '';
     // Check if the user for this row is editable
-    if ( current_user_can( 'edit_user', $user_object->ID ) ) {
+    if ( current_user_can( 'list_users', $user_object->ID ) ) {
         // Set up the user editing link
         // TODO: make profile/user-edit determination a separate function
@@ -1825 +1825 @@
         // Set up the hover actions for this user
         $actions = array();
-        $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
+
+        if ( current_user_can('edit_user',  $user_object->ID) )
+            $actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
         if ( !is_multisite() && $current_user->ID != $user_object->ID && current_user_can('delete_user', $user_object->ID) )
             $actions['delete'] = "<a class='submitdelete' href='" . wp_nonce_url("users.php?action=delete&amp;user=$user_object->ID", 'bulk-users') . "'>" . __('Delete') . "</a>";

trunk/wp-admin/includes/upgrade.php

@@ -441 +441 @@
         upgrade_290();
 
-    if ( $wp_current_db_version < 14138 )
+    if ( $wp_current_db_version < 14139 )
         upgrade_300();
 
@@ -1109 +1109 @@
     global $wp_current_db_version, $wpdb;
 
-    if ( $wp_current_db_version < 12751 ) {
+    if ( $wp_current_db_version < 14139 ) {
         populate_roles_300();
         if ( is_multisite() && is_main_site() && ! defined( 'MULTISITE' ) && get_site_option( 'siteurl' ) === false )
@@ -1116 +1116 @@
 
     // #11866 (Convert the taxonomy children cache into a transient) - Remove old cache.
-    if ( $wp_current_db_version < 14138 ) {
+    if ( $wp_current_db_version < 14139 ) {
         foreach ( get_taxonomies( array('hierarchical' => true) )  as $taxonomy )
             delete_option($taxonomy . '_children');

trunk/wp-admin/menu.php

@@ -173 +173 @@
 unset($menu_perms, $update_plugins, $update_count);
 
-if ( current_user_can('edit_users') )
-    $menu[70] = array( __('Users'), 'edit_users', 'users.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
+if ( current_user_can('list_users') )
+    $menu[70] = array( __('Users'), 'list_users', 'users.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
 else
     $menu[70] = array( __('Profile'), 'read', 'profile.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
 
-if ( current_user_can('edit_users') ) {
+if ( current_user_can('list_users') ) {
     $_wp_real_parent_file['profile.php'] = 'users.php'; // Back-compat for plugins adding submenus to profile.php.
-    $submenu['users.php'][5] = array(__('Authors & Users'), 'edit_users', 'users.php');
+    $submenu['users.php'][5] = array(__('Authors & Users'), 'list_users', 'users.php');
     $submenu['users.php'][10] = array(_x('Add New', 'user'), 'create_users', 'user-new.php');
 

trunk/wp-admin/users.php

@@ -13 +13 @@
 require_once( ABSPATH . WPINC . '/registration.php');
 
-if ( !current_user_can('edit_users') )
+if ( !current_user_can('list_users') )
     wp_die(__('Cheatin’ uh?'));
 

trunk/wp-includes/capabilities.php

@@ -807 +807 @@
         break;
     case 'edit_user':
-        if ( !isset( $args[0] ) || $user_id != $args[0] ) {
-            $caps[] = 'edit_users';
-        }
+        // Allow user to edit itself
+        if ( isset( $args[0] ) && $user_id == $args[0] )
+            break;
+        // Fall through
+    case 'edit_users':
+        // If multisite these caps are allowed only for super admins.
+        if ( is_multisite() && !is_super_admin() )
+            $caps[] = 'do_not_allow';
+        else
+            $caps[] = $cap;
         break;
     case 'delete_post':

trunk/wp-includes/version.php

@@ -16 +16 @@
  * @global int $wp_db_version
  */
-$wp_db_version = 14138;
+$wp_db_version = 14139;
 
 /**