Changeset 29634 for trunk/src/wp-includes/capabilities.php

Timestamp:

08/27/2014 01:31:05 AM (11 years ago)

Author:

nacin

Message:

Plugin/Theme Uploads: New capabilities; unify UIs; ensure compatibility with old filters.

Introduce upload_plugins and upload_themes capabilities to allow blocking of plugin and theme uploads, versus the old hacky (and not secure) ways of just hiding UI tabs. These are simply meta capabilities that map to install_plugins and install_themes.

Also:

• Use the same nice design for the plugin upload screen as the theme upload screen.
• Better compatibility for the old install_themes_tabs filter added in [29002]. see #28578.
• Ensure using the install_plugins_tabs filter to remove the upload tab removes the new button.
• Use 'Add Plugins' instead of 'Install Plugins' to match 'Add Themes'.

fixes #29236.

File:

• trunk/src/wp-includes/capabilities.php (modified) (1 diff)

trunk/src/wp-includes/capabilities.php

@@ -1263 +1263 @@
     case 'delete_plugins':
     case 'install_plugins':
+    case 'upload_plugins':
     case 'update_themes':
     case 'delete_themes':
     case 'install_themes':
+    case 'upload_themes':
     case 'update_core':
         // Disallow anything that creates, deletes, or updates core, plugin, or theme files.
         // Files in uploads are excepted.
-        if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS )
+        if ( defined( 'DISALLOW_FILE_MODS' ) && DISALLOW_FILE_MODS ) {
             $caps[] = 'do_not_allow';
-        elseif ( is_multisite() && ! is_super_admin( $user_id ) )
+        } elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
             $caps[] = 'do_not_allow';
-        else
+        } elseif ( 'upload_themes' === $cap ) {
+            $caps[] = 'install_themes';
+        } elseif ( 'upload_plugins' === $cap ) {
+            $caps[] = 'install_plugins';
+        } else {
             $caps[] = $cap;
+        }
         break;
     case 'activate_plugins':