Changeset 17432

Timestamp:

02/09/2011 05:30:46 PM (14 years ago)

Author:

ryan

Message:

Add additional promote_users checks. Show Add existing button only for multisite. Don't show bulk actions if user can't promote users. Show add new user menu if user has create_users but not promote_users. Props nacin. fixes #16501 for 3.1

Location:

branches/3.1/wp-admin

Files:

• includes/class-wp-users-list-table.php (modified) (1 diff)
• menu.php (modified) (2 diffs)
• user-new.php (modified) (1 diff)
• users.php (modified) (2 diffs)

branches/3.1/wp-admin/includes/class-wp-users-list-table.php

@@ -132 +132 @@
     function extra_tablenav( $which ) {
         if ( 'top' != $which )
+            return;
+        if ( ! current_user_can( 'promote_users' ) )
             return;
 ?>

branches/3.1/wp-admin/menu.php

@@ -192 +192 @@
     $_wp_real_parent_file['profile.php'] = 'users.php'; // Back-compat for plugins adding submenus to profile.php.
     $submenu['users.php'][5] = array(__('Users'), 'list_users', 'users.php');
-    $submenu['users.php'][10] = array(_x('Add New', 'user'), 'promote_users', 'user-new.php');
+    if ( current_user_can('create_users') )
+        $submenu['users.php'][10] = array(_x('Add New', 'user'), 'create_users', 'user-new.php');
+    else
+        $submenu['users.php'][10] = array(_x('Add New', 'user'), 'promote_users', 'user-new.php');
 
     $submenu['users.php'][15] = array(__('Your Profile'), 'read', 'profile.php');
@@ -198 +201 @@
     $_wp_real_parent_file['users.php'] = 'profile.php';
     $submenu['profile.php'][5] = array(__('Your Profile'), 'read', 'profile.php');
-    $submenu['profile.php'][10] = array(__('Add New User'), 'promote_users', 'user-new.php');
+    if ( current_user_can('create_users') )
+        $submenu['profile.php'][10] = array(__('Add New User'), 'create_users', 'user-new.php');
+    else
+        $submenu['profile.php'][10] = array(__('Add New User'), 'promote_users', 'user-new.php');
 }
 

branches/3.1/wp-admin/user-new.php

@@ -10 +10 @@
 require_once('./admin.php');
 
-if ( ! current_user_can('create_users') && ! current_user_can('promote_users') )
-    wp_die(__('Cheatin’ uh?'));
+if ( is_multisite() ) {
+    if ( ! current_user_can( 'create_users' ) && ! current_user_can( 'promote_users' ) )
+        wp_die( __( 'Cheatin’ uh?' ) );
+} elseif ( ! current_user_can( 'create_users' ) ) {
+    wp_die( __( 'Cheatin’ uh?' ) );
+}
 
 if ( is_multisite() ) {

branches/3.1/wp-admin/users.php

@@ -48 +48 @@
 case 'promote':
     check_admin_referer('bulk-users');
+
+    if ( ! current_user_can( 'promote_users' ) )
+        wp_die( __( 'You can’t edit that user.' ) );
 
     if ( empty($_REQUEST['users']) ) {
@@ -353 +356 @@
 if ( current_user_can( 'create_users' ) ) { ?>
     <a href="user-new.php" class="button add-new-h2"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
-<?php } elseif ( current_user_can( 'promote_users' ) ) { ?>
+<?php } elseif ( is_multisite() && current_user_can( 'promote_users' ) ) { ?>
     <a href="user-new.php" class="button add-new-h2"><?php echo esc_html_x( 'Add Existing', 'user' ); ?></a>
 <?php }