Changeset 32913

Timestamp:

06/23/2015 06:19:43 PM (10 years ago)

Author:

wonderboymusic

Message:

The query-attachments AJAX action immediately errors out if the user doesn't have the upload_files cap. As such, the Customizer shouldn't show buttons that launch the media modal when the user doesn't have the proper permissions to query attachments.

See #32654.

Location:

trunk/src

Files:

• wp-admin/custom-background.php (modified) (2 diffs)
• wp-admin/custom-header.php (modified) (1 diff)
• wp-includes/class-wp-customize-control.php (modified) (6 diffs)

trunk/src/wp-admin/custom-background.php

@@ -260 +260 @@
 <?php endif; ?>
 
+<?php if ( current_user_can( 'upload_files' ) ): ?>
 <tr>
 <th scope="row"><?php _e('Select Image'); ?></th>
@@ -279 +280 @@
 </td>
 </tr>
+<?php endif; ?>
 </tbody>
 </table>

trunk/src/wp-admin/custom-header.php

@@ -510 +510 @@
 <?php endif; ?>
 
-<?php if ( current_theme_supports( 'custom-header', 'uploads' ) ) : ?>
+<?php if ( current_user_can( 'upload_files' ) && current_theme_supports( 'custom-header', 'uploads' ) ) : ?>
 <tr>
 <th scope="row"><?php _e( 'Select Image' ); ?></th>

trunk/src/wp-includes/class-wp-customize-control.php

@@ -722 +722 @@
         $this->json['mime_type'] = $this->mime_type;
         $this->json['button_labels'] = $this->button_labels;
+        $this->json['canUpload'] = current_user_can( 'upload_files' );
 
         $value = $this->value();
@@ -824 +825 @@
             </div>
             <div class="actions">
+                <# if ( data.canUpload ) { #>
                 <button type="button" class="button remove-button"><?php echo $this->button_labels['remove']; ?></button>
                 <button type="button" class="button upload-button" id="{{ data.settings['default'] }}-button"><?php echo $this->button_labels['change']; ?></button>
                 <div style="clear:both"></div>
+                <# } #>
             </div>
         <# } else { #>
@@ -844 +847 @@
                     <button type="button" class="button default-button"><?php echo $this->button_labels['default']; ?></button>
                 <# } #>
+                <# if ( data.canUpload ) { #>
                 <button type="button" class="button upload-button" id="{{ data.settings['default'] }}-button"><?php echo $this->button_labels['select']; ?></button>
+                <# } #>
                 <div style="clear:both"></div>
             </div>
@@ -1159 +1164 @@
         $height = absint( get_theme_support( 'custom-header', 'height' ) );
         ?>
-
-
         <div class="customize-control-content">
             <p class="customizer-section-intro">
@@ -1181 +1184 @@
             </div>
             <div class="actions">
+                <?php if ( current_user_can( 'upload_files' ) ): ?>
                 <?php /* translators: Hide as in hide header image via the Customizer */ ?>
                 <button type="button"<?php echo $visibility ?> class="button remove"><?php _ex( 'Hide image', 'custom header' ); ?></button>
@@ -1186 +1190 @@
                 <button type="button" class="button new"><?php _ex( 'Add new image', 'header image' ); ?></button>
                 <div style="clear:both"></div>
+                <?php endif; ?>
             </div>
             <div class="choices">