Changeset 14581 for trunk/wp-admin/themes.php

Timestamp:

05/12/2010 07:19:57 PM (15 years ago)

Author:

nacin

Message:

Use the edit_theme_options capability. fixes #13290.

File:

• trunk/wp-admin/themes.php (modified) (5 diffs)

trunk/wp-admin/themes.php

@@ -10 +10 @@
 require_once('./admin.php');
 
-if ( !current_user_can('switch_themes') )
+if ( !current_user_can('switch_themes') && !current_user_can('edit_theme_options') )
     wp_die( __( 'Cheatin’ uh?' ) );
 
-if ( isset($_GET['action']) ) {
+if ( current_user_can('switch_themes') && isset($_GET['action']) ) {
     if ( 'activate' == $_GET['action'] ) {
         check_admin_referer('switch-theme_' . $_GET['template']);
@@ -32 +32 @@
 $parent_file = 'themes.php';
 
+if ( current_user_can( 'switch_themes' ) ) :
+
 $help = '<p>' . __('Themes give your WordPress style. Once a theme is installed, you may preview it, activate it or deactivate it here.') . '</p>';
 if ( current_user_can('install_themes') ) {
@@ -43 +45 @@
 wp_enqueue_script( 'theme-preview' );
 
+endif;
+
 require_once('./admin-header.php');
 if ( is_multisite() && current_user_can('edit_themes') ) {
@@ -52 +56 @@
 <div id="message1" class="updated"><p><?php _e('The active theme is broken.  Reverting to the default theme.'); ?></p></div>
 <?php elseif ( isset($_GET['activated']) ) :
-        if ( isset($wp_registered_sidebars) && count( (array) $wp_registered_sidebars ) ) { ?>
+        if ( isset($wp_registered_sidebars) && count( (array) $wp_registered_sidebars ) && current_user_can('edit_theme_options') ) { ?>
 <div id="message2" class="updated"><p><?php printf( __('New theme activated. This theme supports widgets, please visit the <a href="%s">widgets settings</a> screen to configure them.'), admin_url( 'widgets.php' ) ); ?></p></div><?php
         } else { ?>
@@ -115 +119 @@
 
 <div class="clear"></div>
+<?php
+if ( ! current_user_can( 'switch_themes' ) ) {
+    echo '</div>';
+    require( './admin-footer.php' );
+    exit;
+}
+?>
 <h3><?php _e('Available Themes'); ?></h3>
 <div class="clear"></div>