Changeset 16990

Timestamp:

12/16/2010 08:43:22 AM (14 years ago)

Author:

nacin

Message:

Remove check_permissions() calls outside of AJAX context. Also only check for switch_themes in check_permissions() for the themes table. see #15326.

Location:

trunk/wp-admin

Files:

• edit-comments.php (modified) (1 diff)
• edit-tags.php (modified) (1 diff)
• edit.php (modified) (1 diff)
• includes/class-wp-ms-themes-list-table.php (modified) (1 diff)
• includes/class-wp-plugins-list-table.php (modified) (1 diff)
• includes/class-wp-themes-list-table.php (modified) (1 diff)
• includes/class-wp-users-list-table.php (modified) (1 diff)
• link-manager.php (modified) (1 diff)
• network/site-themes.php (modified) (2 diffs)
• network/site-users.php (modified) (1 diff)
• network/sites.php (modified) (1 diff)
• network/themes.php (modified) (2 diffs)
• network/users.php (modified) (1 diff)
• plugin-install.php (modified) (2 diffs)
• plugins.php (modified) (1 diff)
• theme-install.php (modified) (2 diffs)
• themes.php (modified) (1 diff)
• upload.php (modified) (1 diff)
• users.php (modified) (1 diff)

trunk/wp-admin/edit-comments.php

@@ -13 +13 @@
 
 $wp_list_table = get_list_table('WP_Comments_List_Table');
-$wp_list_table->check_permissions();
 $pagenum = $wp_list_table->get_pagenum();
 

trunk/wp-admin/edit-tags.php

@@ -14 +14 @@
 
 $wp_list_table = get_list_table('WP_Terms_List_Table');
-$wp_list_table->check_permissions();
 
 $title = $tax->labels->name;

trunk/wp-admin/edit.php

@@ -25 +25 @@
 
 $wp_list_table = get_list_table('WP_Posts_List_Table');
-$wp_list_table->check_permissions();
 $pagenum = $wp_list_table->get_pagenum();
 

trunk/wp-admin/includes/class-wp-ms-themes-list-table.php

@@ -40 +40 @@
         $menu_perms = get_site_option( 'menu_items', array() );
 
-        if ( empty( $menu_perms['themes'] ) ) {
-            if ( !is_super_admin() )
-                wp_die( __( 'Cheatin’ uh?' ) );
-        }
+        if ( empty( $menu_perms['themes'] ) && ! is_super_admin() )
+            wp_die( __( 'Cheatin’ uh?' ) );
 
         if ( $this->is_site_themes && !current_user_can('manage_sites') )
             wp_die( __( 'You do not have sufficient permissions to manage themes for this site.' ) );
-        else if ( !$this->is_site_themes && !current_user_can('manage_network_themes') )
+        elseif ( !$this->is_site_themes && !current_user_can('manage_network_themes') )
             wp_die( __( 'You do not have sufficient permissions to manage network themes.' ) );
     }

trunk/wp-admin/includes/class-wp-plugins-list-table.php

@@ -32 +32 @@
             $menu_perms = get_site_option( 'menu_items', array() );
 
-            if ( empty( $menu_perms['plugins'] ) ) {
-                if ( !is_super_admin() )
-                    wp_die( __( 'Cheatin’ uh?' ) );
-            }
+            if ( empty( $menu_perms['plugins'] ) && ! is_super_admin() )
+                wp_die( __( 'Cheatin’ uh?' ) );
         }
 

trunk/wp-admin/includes/class-wp-themes-list-table.php

@@ -13 +13 @@
 
     function check_permissions() {
-        if ( !current_user_can('switch_themes') && !current_user_can('edit_theme_options') )
+        // Do not check edit_theme_options here. AJAX calls for available themes require switch_themes.
+        if ( !current_user_can('switch_themes') )
             wp_die( __( 'Cheatin’ uh?' ) );
     }

trunk/wp-admin/includes/class-wp-users-list-table.php

@@ -26 +26 @@
 
     function check_permissions() {
-        if ( !current_user_can('list_users') )
-            wp_die(__('Cheatin’ uh?'));
-
-        if ( $this->is_site_users && !current_user_can('manage_sites') )
-            wp_die(__('You do not have sufficient permissions to edit this site.'));
+        if ( ! $this->is_site_users && ! current_user_can( 'list_users' ) )
+            wp_die( __( 'Cheatin’ uh?' ) );
+
+        if ( $this->is_site_users && ! current_user_can( 'manage_sites' ) )
+            wp_die(__( 'You do not have sufficient permissions to edit this site.' ) );
     }
 

trunk/wp-admin/link-manager.php

@@ -13 +13 @@
 
 $wp_list_table = get_list_table('WP_Links_List_Table');
-$wp_list_table->check_permissions();
 
 // Handle bulk deletes

trunk/wp-admin/network/site-themes.php

@@ -16 +16 @@
 $menu_perms = get_site_option( 'menu_items', array() );
 
-if ( empty( $menu_perms['themes'] ) ) {
-    if ( !is_super_admin() )
-        wp_die( __( 'Cheatin’ uh?' ) );
-}
+if ( empty( $menu_perms['themes'] ) && ! is_super_admin() )
+    wp_die( __( 'Cheatin’ uh?' ) );
 
-if ( !current_user_can('manage_sites') )
+if ( ! current_user_can( 'manage_sites' ) )
     wp_die( __( 'You do not have sufficient permissions to manage themes for this site.' ) );
 
@@ -35 +33 @@
 
 $wp_list_table = get_list_table('WP_MS_Themes_List_Table');
-$wp_list_table->check_permissions();
 
 $action = $wp_list_table->current_action();

trunk/wp-admin/network/site-users.php

@@ -18 +18 @@
 
 $wp_list_table = get_list_table('WP_Users_List_Table');
-$wp_list_table->check_permissions();
 $wp_list_table->prepare_items();
 

trunk/wp-admin/network/sites.php

@@ -14 +14 @@
     wp_die( __( 'Multisite support is not enabled.' ) );
 
+if ( ! current_user_can( 'manage_sites' ) )
+    wp_die( __( 'You do not have permission to access this page.' ) );
+
 $wp_list_table = get_list_table('WP_MS_Sites_List_Table');
-$wp_list_table->check_permissions();
 
 $title = __( 'Sites' );

trunk/wp-admin/network/themes.php

@@ -16 +16 @@
 $menu_perms = get_site_option( 'menu_items', array() );
 
-if ( empty( $menu_perms['themes'] ) ) {
-    if ( !is_super_admin() )
-        wp_die( __( 'Cheatin’ uh?' ) );
-}
+if ( empty( $menu_perms['themes'] ) && ! is_super_admin() )
+    wp_die( __( 'Cheatin’ uh?' ) );
 
 if ( !current_user_can('manage_network_themes') )
@@ -25 +23 @@
 
 $wp_list_table = get_list_table('WP_MS_Themes_List_Table');
-$wp_list_table->check_permissions();
 
 $action = $wp_list_table->current_action();

trunk/wp-admin/network/users.php

@@ -14 +14 @@
     wp_die( __( 'Multisite support is not enabled.' ) );
 
+if ( ! current_user_can( 'manage_network_users' ) )
+    wp_die( __( 'You do not have permission to access this page.' ) );
+
 $wp_list_table = get_list_table('WP_MS_Users_List_Table');
-$wp_list_table->check_permissions();
 $wp_list_table->prepare_items();
 

trunk/wp-admin/plugin-install.php

@@ -12 +12 @@
 /** WordPress Administration Bootstrap */
 require_once('./admin.php');
+
 if ( ! current_user_can('install_plugins') )
     wp_die(__('You do not have sufficient permissions to install plugins on this site.'));
@@ -21 +22 @@
 
 $wp_list_table = get_list_table('WP_Plugin_Install_List_Table');
-$wp_list_table->check_permissions();
 $wp_list_table->prepare_items();
 

trunk/wp-admin/plugins.php

@@ -10 +10 @@
 require_once('./admin.php');
 
+if ( is_multisite() ) {
+    $menu_perms = get_site_option( 'menu_items', array() );
+
+    if ( empty( $menu_perms['plugins'] ) && ! is_super_admin() )
+        wp_die( __( 'Cheatin’ uh?' ) );
+}
+
 if ( !current_user_can('activate_plugins') )
     wp_die( __( 'You do not have sufficient permissions to manage plugins for this site.' ) );
 
 $wp_list_table = get_list_table('WP_Plugins_List_Table');
-$wp_list_table->check_permissions();
 
 $action = $wp_list_table->current_action();

trunk/wp-admin/theme-install.php

@@ -12 +12 @@
 /** WordPress Administration Bootstrap */
 require_once('./admin.php');
+
 if ( ! current_user_can('install_themes') )
     wp_die( __( 'You do not have sufficient permissions to install themes on this site.' ) );
@@ -21 +22 @@
 
 $wp_list_table = get_list_table('WP_Theme_Install_List_Table');
-$wp_list_table->check_permissions();
 $wp_list_table->prepare_items();
 

trunk/wp-admin/themes.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once('./admin.php');
+
 if ( !current_user_can('switch_themes') && !current_user_can('edit_theme_options') )
     wp_die( __( 'Cheatin’ uh?' ) );
 
 $wp_list_table = get_list_table('WP_Themes_List_Table');
-$wp_list_table->check_permissions();
 
 if ( current_user_can( 'switch_themes' ) && isset($_GET['action'] ) ) {

trunk/wp-admin/upload.php

@@ -10 +10 @@
 require_once( './admin.php' );
 
+if ( !current_user_can('upload_files') )
+    wp_die( __( 'You do not have permission to upload files.' ) );
+
 $wp_list_table = get_list_table('WP_Media_List_Table');
-$wp_list_table->check_permissions();
 
 // Handle bulk actions

trunk/wp-admin/users.php

@@ -10 +10 @@
 require_once( './admin.php' );
 
+if ( ! current_user_can( 'list_users' ) )
+    wp_die( __( 'Cheatin’ uh?' ) );
+
 $wp_list_table = get_list_table('WP_Users_List_Table');
-$wp_list_table->check_permissions();
 
 $title = __('Users');