Changeset 30888 for trunk/src/wp-admin/user-edit.php

Timestamp:

12/16/2014 09:15:01 AM (10 years ago)

Author:

nacin

Message:

Updates to the 'Log out everywhere' implementation.

• Include a message and a disabled button when you're only logged in at one location.
• Avoid leaking the session token in HTML.
• Simplify, simplify, simplify.

see #30264.

File:

• trunk/src/wp-admin/user-edit.php (modified) (4 diffs)

trunk/src/wp-admin/user-edit.php

@@ -25 +25 @@
 
 wp_enqueue_script('user-profile');
-
-wp_localize_script(
-    'user-profile',
-    '_wpSessionMangager',
-    array(
-        'user_id' => $user_id,
-        'nonce'   => wp_create_nonce( sprintf( 'destroy_sessions_%d', $user_id ) ),
-    )
-);
 
 $title = IS_PROFILE_PAGE ? __('Profile') : __('Edit User');
@@ -494 +485 @@
 <?php endif; ?>
 
-<?php if ( IS_PROFILE_PAGE && ( count( $sessions->get_all() ) > 1 ) ) { ?>
+<?php
+if ( IS_PROFILE_PAGE && count( $sessions->get_all() ) === 1 ) : ?>
     <tr class="user-sessions-wrap hide-if-no-js">
         <th>&nbsp;</th>
         <td aria-live="assertive">
-            <div class="destroy-sessions"><button class="button button-secondary" id="destroy-sessions" data-token="<?php echo esc_attr( wp_get_session_token() ); ?>"><?php _e( 'Log Out of All Other Sessions' ); ?></button></div>
+            <div class="destroy-sessions"><button disabled class="button button-secondary"><?php _e( 'Log Out of All Other Sessions' ); ?></button></div>
+            <p class="description">
+                <?php _e( 'You are only logged in at this location.' ); ?>
+            </p>
+        </td>
+    </tr>
+<?php elseif ( IS_PROFILE_PAGE && count( $sessions->get_all() ) > 1 ) : ?>
+    <tr class="user-sessions-wrap hide-if-no-js">
+        <th>&nbsp;</th>
+        <td aria-live="assertive">
+            <div class="destroy-sessions"><button class="button button-secondary" id="destroy-sessions"><?php _e( 'Log Out of All Other Sessions' ); ?></button></div>
             <p class="description">
                 <?php _e( 'Left your account logged in at a public computer? Lost your phone? This will log you out everywhere except your current browser.' ); ?>
@@ -504 +506 @@
         </td>
     </tr>
-<?php } else if ( ! IS_PROFILE_PAGE && ( count( $sessions->get_all() ) > 0 ) ) { ?>
+<?php elseif ( ! IS_PROFILE_PAGE && $sessions->get_all() ) : ?>
     <tr class="user-sessions-wrap hide-if-no-js">
         <th>&nbsp;</th>
@@ -517 +519 @@
         </td>
     </tr>
-<?php } ?>
+<?php endif; ?>
 
 </table>