Changeset 21195

Timestamp:

06/30/2012 12:08:18 PM (14 years ago)

Author:

nacin

Message:

Cap checks in the upgrader so we do not show links the user cannot access. props linuxologos for the initial patch. see #19824.

Also fixes a rare fatal error when theme_info is not set when updating a theme that is already up to date.

File:

• trunk/wp-admin/includes/class-wp-upgrader.php (modified) (6 diffs)

trunk/wp-admin/includes/class-wp-upgrader.php

@@ -852 +852 @@
                         $this->update_current++;
 
+                        $this->skin->theme_info = $this->theme_info($theme);
+
                         if ( !isset( $current->response[ $theme ] ) ) {
                                 $this->skin->set_result(false);
@@ -860 +862 @@
                                 continue;
                         }
-
-                        $this->skin->theme_info = $this->theme_info($theme);
 
                         // Get the URL to the zip file
@@ -1352 +1352 @@
                         'updates_page' => '<a href="' . self_admin_url('update-core.php') . '" title="' . esc_attr__('Go to WordPress Updates page') . '" target="_parent">' . __('Return to WordPress Updates') . '</a>'
                 );
+                if ( ! current_user_can( 'activate_plugins' ) )
+                        unset( $update_actions['plugins_page'] );
 
                 $update_actions = apply_filters('update_bulk_plugins_complete_actions', $update_actions, $this->plugin_info);
@@ -1385 +1387 @@
                         'updates_page' => '<a href="' . self_admin_url('update-core.php') . '" title="' . esc_attr__('Go to WordPress Updates page') . '" target="_parent">' . __('Return to WordPress Updates') . '</a>'
                 );
+                if ( ! current_user_can( 'switch_themes' ) && ! current_user_can( 'edit_theme_options' ) )
+                        unset( $update_actions['themes_page'] );
 
                 $update_actions = apply_filters('update_bulk_theme_complete_actions', $update_actions, $this->theme_info );
@@ -1518 +1522 @@
                 if ( $this->type == 'web' )
                         $install_actions['themes_page'] = '<a href="' . self_admin_url('theme-install.php') . '" title="' . esc_attr__('Return to Theme Installer') . '" target="_parent">' . __('Return to Theme Installer') . '</a>';
-                else
+                elseif ( current_user_can( 'switch_themes' ) || current_user_can( 'edit_theme_options' ) )
                         $install_actions['themes_page'] = '<a href="' . self_admin_url('themes.php') . '" title="' . esc_attr__('Themes page') . '" target="_parent">' . __('Return to Themes page') . '</a>';
 
-                if ( ! $this->result || is_wp_error($this->result) || is_network_admin() )
+                if ( ! $this->result || is_wp_error($this->result) || is_network_admin() || ! current_user_can( 'switch_themes' ) )
                         unset( $install_actions['activate'], $install_actions['preview'] );
 
@@ -1573 +1577 @@
 
                         if ( get_stylesheet() == $stylesheet ) {
-                                $update_actions['preview']  = '<a href="' . wp_customize_url( $stylesheet ) . '" class="hide-if-no-customize load-customize" title="' . esc_attr( sprintf( __('Customize &#8220;%s&#8221;'), $name ) ) . '">' . __('Customize') . '</a>';
-                        } else {
+                                if ( current_user_can( 'edit_theme_options' ) )
+                                        $update_actions['preview']  = '<a href="' . wp_customize_url( $stylesheet ) . '" class="hide-if-no-customize load-customize" title="' . esc_attr( sprintf( __('Customize &#8220;%s&#8221;'), $name ) ) . '">' . __('Customize') . '</a>';
+                        } elseif ( current_user_can( 'switch_themes' ) ) {
                                 $update_actions['preview']  = '<a href="' . esc_url( $preview_link ) . '" class="hide-if-customize" title="' . esc_attr( sprintf( __('Preview &#8220;%s&#8221;'), $name ) ) . '">' . __('Preview') . '</a>';
                                 $update_actions['preview'] .= '<a href="' . wp_customize_url( $stylesheet ) . '" class="hide-if-no-customize load-customize" title="' . esc_attr( sprintf( __('Preview &#8220;%s&#8221;'), $name ) ) . '">' . __('Live Preview') . '</a>';