Changeset 17275

Timestamp:

01/13/2011 12:22:53 AM (16 years ago)

Author:

nacin

Message:

Move wp_redirect calls to the end of the switch in users.php. Fix unrelated bug where the user's cap should be check, rather than their role's cap. see #16166.

File:

• trunk/wp-admin/users.php (modified) (16 diffs)

trunk/wp-admin/users.php

@@ -43 +43 @@
 $update = '';
 
-switch ( $wp_list_table->current_action() ) {
+if ( $doaction = $wp_list_table->current_action() ) {
+
+switch ( $doaction ) {
 
 /* Bulk Dropdown menu Role changes */
@@ -49 +51 @@
         check_admin_referer('bulk-users');
 
-        if ( empty($_REQUEST['users']) ) {
-                wp_redirect($redirect);
-                exit();
-        }
+        if ( empty($_REQUEST['users']) )
+                break;
 
         $editable_roles = get_editable_roles();
@@ -66 +66 @@
                         wp_die(__('You can’t edit that user.'));
                 // The new role of the current user must also have promote_users caps
-                if ( $id == $current_user->ID && !$wp_roles->role_objects[$_REQUEST['new_role']]->has_cap('promote_users') ) {
+                if ( $id == $current_user->ID && ! current_user_can('promote_users') ) {
                         $update = 'err_admin_role';
                         continue;
@@ -79 +79 @@
         }
 
-        wp_redirect(add_query_arg('update', $update, $redirect));
-        exit();
+        $redirect = add_query_arg( 'update', $update, $redirect );
 
 break;
@@ -90 +89 @@
         check_admin_referer('delete-users');
 
-        if ( empty($_REQUEST['users']) ) {
-                wp_redirect($redirect);
-                exit();
-        }
+        if ( empty($_REQUEST['users']) )
+                break;
 
         if ( ! current_user_can( 'delete_users' ) )
@@ -126 +123 @@
 
         $redirect = add_query_arg( array('delete_count' => $delete_count, 'update' => $update), $redirect);
-        wp_redirect($redirect);
-        exit();
 
 break;
@@ -137 +132 @@
         check_admin_referer('bulk-users');
 
-        if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) {
-                wp_redirect($redirect);
-                exit();
-        }
+        if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) )
+                break;
 
         if ( ! current_user_can( 'delete_users' ) )
@@ -149 +142 @@
         else
                 $userids = $_REQUEST['users'];
+
+        $redirect = false;
 
         include ('admin-header.php');
@@ -192 +187 @@
 </form>
 <?php
+include('./admin-footer.php');
 
 break;
@@ -198 +194 @@
         check_admin_referer('remove-users');
 
-        if ( empty($_REQUEST['users']) ) {
-                wp_redirect($redirect);
-                exit;
-        }
+        if ( empty($_REQUEST['users']) )
+                break;
 
         if ( !current_user_can('remove_users')  )
@@ -223 +217 @@
 
         $redirect = add_query_arg( array('update' => $update), $redirect);
-        wp_redirect($redirect);
-        exit;
 
 break;
@@ -232 +224 @@
         check_admin_referer('bulk-users');
 
-        if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) {
-                wp_redirect($redirect);
-                exit();
-        }
+        if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) )
+                break;
 
         if ( !current_user_can('remove_users') )
@@ -244 +234 @@
         else
                 $userids = $_REQUEST['users'];
+
+        $redirect = false;
 
         include ('admin-header.php');
@@ -280 +272 @@
 </form>
 <?php
+include('./admin-footer.php');
 
 break;
@@ -285 +278 @@
 default:
 
-        if ( !empty($_GET['_wp_http_referer']) ) {
+} // end of the $doaction switch
+
+        if ( $redirect )
+                wp_redirect( $redirect );
+        exit();
+
+} // end of the $doaction if
+elseif ( !empty($_GET['_wp_http_referer']) ) {
                 wp_redirect(remove_query_arg(array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI'])));
                 exit;
-        }
+}
 
         $wp_list_table->prepare_items();
@@ -379 +379 @@
 </div>
 <?php
-break;
-
-} // end of the $doaction switch
 
 include('./admin-footer.php');