Changeset 29634

Timestamp:

08/27/2014 01:31:05 AM (10 years ago)

Author:

nacin

Message:

Plugin/Theme Uploads: New capabilities; unify UIs; ensure compatibility with old filters.

Introduce upload_plugins and upload_themes capabilities to allow blocking of plugin and theme uploads, versus the old hacky (and not secure) ways of just hiding UI tabs. These are simply meta capabilities that map to install_plugins and install_themes.

Also:

• Use the same nice design for the plugin upload screen as the theme upload screen.
• Better compatibility for the old install_themes_tabs filter added in [29002]. see #28578.
• Ensure using the install_plugins_tabs filter to remove the upload tab removes the new button.
• Use 'Add Plugins' instead of 'Install Plugins' to match 'Add Themes'.

fixes #29236.

Location:

trunk/src

Files:

• wp-admin/css/themes.css (modified) (3 diffs)
• wp-admin/includes/class-wp-plugin-install-list-table.php (modified) (2 diffs)
• wp-admin/includes/plugin-install.php (modified) (2 diffs)
• wp-admin/plugin-install.php (modified) (2 diffs)
• wp-admin/theme-install.php (modified) (2 diffs)
• wp-admin/update.php (modified) (2 diffs)
• wp-includes/capabilities.php (modified) (1 diff)

trunk/src/wp-admin/css/themes.css

@@ -1092 +1092 @@
     display: inline;
 }
-.upload-theme {
+.upload-theme,
+.upload-plugin {
     -webkit-box-sizing: border-box;
     -moz-box-sizing: border-box;
@@ -1104 +1105 @@
     top: 10px;
 }
-body.show-upload-theme .upload-theme {
-    display: block;
-}
-.upload-theme .wp-upload-form {
+body.show-upload-theme .upload-theme,
+.upload-plugin {
+    display: block;
+}
+.upload-theme .wp-upload-form,
+.upload-plugin .wp-upload-form {
     background: #fafafa;
     border: 1px solid #e5e5e5;
@@ -1114 +1117 @@
     max-width: 380px;
 }
-.upload-theme .install-help {
+.upload-theme .install-help,
+.upload-plugin .install-help {
     color: #999;
     font-size: 18px;

trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php

@@ -70 +70 @@
             $tabs['beta']      = _x( 'Beta Testing', 'Plugin Installer' );
         }
-
-        $nonmenu_tabs = array( 'upload', 'plugin-information' ); //Valid actions to perform which do not have a Menu item.
+        if ( current_user_can( 'upload_plugins' ) ) {
+            // No longer a real tab. Here for filter compatibility.
+            // Gets juggled into $nonmenu_tabs below.
+            $tabs['upload'] = __( 'Upload Plugin' );
+        }
+
+        $nonmenu_tabs = array( 'plugin-information' ); // Valid actions to perform which do not have a Menu item.
 
         /**
@@ -91 +96 @@
          */
         $nonmenu_tabs = apply_filters( 'install_plugins_nonmenu_tabs', $nonmenu_tabs );
+
+        if ( isset( $tabs['upload'] ) ) {
+            unset( $tabs['upload'] );
+            $nonmenu_tabs[] = 'upload';
+        }
 
         // If a non-valid menu tab has been selected, And it's not a non-menu action.

trunk/src/wp-admin/includes/plugin-install.php

@@ -196 +196 @@
 function install_plugins_upload( $page = 1 ) {
 ?>
-    <h4><?php _e('Install a plugin in .zip format'); ?></h4>
+<div class="upload-plugin">
     <p class="install-help"><?php _e('If you have a plugin in a .zip format, you may install it by uploading it here.'); ?></p>
     <form method="post" enctype="multipart/form-data" class="wp-upload-form" action="<?php echo self_admin_url('update.php?action=upload-plugin'); ?>">
@@ -204 +204 @@
         <?php submit_button( __( 'Install Now' ), 'button', 'install-plugin-submit', false ); ?>
     </form>
+</div>
 <?php
 }

trunk/src/wp-admin/plugin-install.php

@@ -27 +27 @@
 $wp_list_table->prepare_items();
 
-$title = __('Install Plugins');
+$title = __( 'Add Plugins' );
 $parent_file = 'plugins.php';
 
@@ -76 +76 @@
 <h2>
     <?php
-        echo esc_html( $title );
-        $href = self_admin_url( 'plugin-install.php?tab=upload' );
+    echo esc_html( $title );
+    if ( ! empty( $tabs['upload'] ) && current_user_can( 'upload_plugins' ) ) {
+        if ( $tab === 'upload' ) {
+            $href = self_admin_url( 'plugin-install.php' );
+            $text = _x( 'Browse', 'plugins' );
+        } else {
+            $href = self_admin_url( 'plugin-install.php?tab=upload' );
+            $text = __( 'Upload Plugin' );
+        }
+        echo ' <a href="' . $href . '" class="upload add-new-h2">' . $text . '</a>';
+    }
     ?>
-    <a href="<?php echo $href; ?>" class="upload add-new-h2"><?php _e( 'Upload Plugin' ); ?></a>
 </h2>
 
-<?php $wp_list_table->views(); ?>
+<?php
+if ( $tab !== 'upload' ) {
+    $wp_list_table->views();
+    echo '<br class="clear" />';
+}
 
-<br class="clear" />
-<?php
 /**
  * Fires after the plugins list table in each tab of the Install Plugins screen.

trunk/src/wp-admin/theme-install.php

@@ -27 +27 @@
     $submenu_file = 'themes.php';
 }
-
-$tabs = array(
-    'upload'        => __( 'Upload Theme' ),
-    'browse-themes' => _x( 'Browse', 'themes' ),
-);
 
 $sections = array(
@@ -114 +109 @@
 ?>
 <div class="wrap">
-    <h2>
-        <?php echo esc_html( $title ); ?>
-        <?php
-        /**
-         * Filter the tabs shown on the Install Themes screen.
-         * 
-         * @since 2.8.0
-         * @param array $tabs The tabs shown on the Install Themes screen. Defaults are
-         *                    'upload' and 'browse-themes'.
-         */
-        $tabs = apply_filters( 'install_themes_tabs', $tabs );
-        foreach ( $tabs as $tab_slug => $tab_name ) {
-            echo '<a href="#" class="' . esc_attr( $tab_slug ) . ' add-new-h2">' . $tab_name . '</a>';
-        }
-        ?>
-    </h2>
+    <h2><?php
+    echo esc_html( $title );
+
+    /**
+     * Filter the tabs shown on the Add Themes screen.
+     *
+     * This filter is for backwards compatibility only,
+     * for the suppression of the upload tab.
+     *
+     * @since 2.8.0
+     * @param array $tabs The tabs shown on the Add Themes screen. Default is 'upload'.
+     */
+    $tabs = apply_filters( 'install_themes_tabs', array( 'upload' => __( 'Upload Theme' ) ) );
+    if ( ! empty( $tabs['upload'] ) && current_user_can( 'upload_themes' ) ) {
+        echo ' <a href="#" class="upload add-new-h2">' . __( 'Upload Theme' ) . '</a>';
+        echo ' <a href="#" class="browse-themes add-new-h2">' . _x( 'Browse', 'themes' ) . '</a>';
+    }
+    ?></h2>
 
     <div class="upload-theme">

trunk/src/wp-admin/update.php

@@ -124 +124 @@
     } elseif ( 'upload-plugin' == $action ) {
 
-        if ( ! current_user_can('install_plugins') )
+        if ( ! current_user_can( 'upload_plugins' ) ) {
             wp_die( __( 'You do not have sufficient permissions to install plugins on this site.' ) );
+        }
 
         check_admin_referer('plugin-upload');
@@ -228 +229 @@
     } elseif ( 'upload-theme' == $action ) {
 
-        if ( ! current_user_can('install_themes') )
+        if ( ! current_user_can( 'upload_themes' ) ) {
             wp_die( __( 'You do not have sufficient permissions to install themes on this site.' ) );
+        }
 
         check_admin_referer('theme-upload');

trunk/src/wp-includes/capabilities.php

@@ -1263 +1263 @@
     case 'delete_plugins':
     case 'install_plugins':
+    case 'upload_plugins':
     case 'update_themes':
     case 'delete_themes':
     case 'install_themes':
+    case 'upload_themes':
     case 'update_core':
         // Disallow anything that creates, deletes, or updates core, plugin, or theme files.
         // Files in uploads are excepted.
-        if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
+        if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
             $caps[] = 'do_not_allow';
-        elseif ( is_multisite() && ! is_super_admin( $user_id ) )
+        } elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
             $caps[] = 'do_not_allow';
-        else
+        } elseif ( 'upload_themes' === $cap ) {
+            $caps[] = 'install_themes';
+        } elseif ( 'upload_plugins' === $cap ) {
+            $caps[] = 'install_plugins';
+        } else {
             $caps[] = $cap;
+        }
         break;
     case 'activate_plugins':