Changeset 17275

Timestamp:

01/13/2011 12:22:53 AM (14 years ago)

Author:

nacin

Message:

Move wp_redirect calls to the end of the switch in users.php. Fix unrelated bug where the user's cap should be check, rather than their role's cap. see #16166.

File:

• trunk/wp-admin/users.php (modified) (16 diffs)

trunk/wp-admin/users.php

@@ -43 +43 @@
 $update = '';
 
-switch ( $wp_list_table->current_action() ) {
+if ( $doaction = $wp_list_table->current_action() ) {
+
+switch ( $doaction ) {
 
 /* Bulk Dropdown menu Role changes */
@@ -49 +51 @@
     check_admin_referer('bulk-users');
 
-    if ( empty($_REQUEST['users']) ) {
-        wp_redirect($redirect);
-        exit();
-    }
+    if ( empty($_REQUEST['users']) )
+        break;
 
     $editable_roles = get_editable_roles();
@@ -66 +66 @@
             wp_die(__('You can’t edit that user.'));
         // The new role of the current user must also have promote_users caps
-        if ( $id == $current_user->ID && !$wp_roles->role_objects[$_REQUEST['new_role']]->has_cap('promote_users') ) {
+        if ( $id == $current_user->ID && ! current_user_can('promote_users') ) {
             $update = 'err_admin_role';
             continue;
@@ -79 +79 @@
     }
 
-    wp_redirect(add_query_arg('update', $update, $redirect));
-    exit();
+    $redirect = add_query_arg( 'update', $update, $redirect );
 
 break;
@@ -90 +89 @@
     check_admin_referer('delete-users');
 
-    if ( empty($_REQUEST['users']) ) {
-        wp_redirect($redirect);
-        exit();
-    }
+    if ( empty($_REQUEST['users']) )
+        break;
 
     if ( ! current_user_can( 'delete_users' ) )
@@ -126 +123 @@
 
     $redirect = add_query_arg( array('delete_count' => $delete_count, 'update' => $update), $redirect);
-    wp_redirect($redirect);
-    exit();
 
 break;
@@ -137 +132 @@
     check_admin_referer('bulk-users');
 
-    if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) {
-        wp_redirect($redirect);
-        exit();
-    }
+    if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) )
+        break;
 
     if ( ! current_user_can( 'delete_users' ) )
@@ -149 +142 @@
     else
         $userids = $_REQUEST['users'];
+
+    $redirect = false;
 
     include ('admin-header.php');
@@ -192 +187 @@
 </form>
 <?php
+include('./admin-footer.php');
 
 break;
@@ -198 +194 @@
     check_admin_referer('remove-users');
 
-    if ( empty($_REQUEST['users']) ) {
-        wp_redirect($redirect);
-        exit;
-    }
+    if ( empty($_REQUEST['users']) )
+        break;
 
     if ( !current_user_can('remove_users')  )
@@ -223 +217 @@
 
     $redirect = add_query_arg( array('update' => $update), $redirect);
-    wp_redirect($redirect);
-    exit;
 
 break;
@@ -232 +224 @@
     check_admin_referer('bulk-users');
 
-    if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) {
-        wp_redirect($redirect);
-        exit();
-    }
+    if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) )
+        break;
 
     if ( !current_user_can('remove_users') )
@@ -244 +234 @@
     else
         $userids = $_REQUEST['users'];
+
+    $redirect = false;
 
     include ('admin-header.php');
@@ -280 +272 @@
 </form>
 <?php
+include('./admin-footer.php');
 
 break;
@@ -285 +278 @@
 default:
 
-    if ( !empty($_GET['_wp_http_referer']) ) {
+} // end of the $doaction switch
+
+    if ( $redirect )
+        wp_redirect( $redirect );
+    exit();
+
+} // end of the $doaction if
+elseif ( !empty($_GET['_wp_http_referer']) ) {
         wp_redirect(remove_query_arg(array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI'])));
         exit;
-    }
+}
 
     $wp_list_table->prepare_items();
@@ -379 +379 @@
 </div>
 <?php
-break;
-
-} // end of the $doaction switch
 
 include('./admin-footer.php');