Changeset 33173

Timestamp:

07/12/2015 02:35:11 AM (11 years ago)

Author:

jeremyfelt

Message:

Add better handling for actions and messaging in MS Sites List Table row actions

• Simplify URLs used for row actions to remove messaging and site domain/path.
• Use confirmation messaging from a managed list of actions when handling the request.
• Find the site address from the site ID rather than using information passed in the URL.

Fixes #32963.

Location:

trunk/src/wp-admin

Files:

• includes/class-wp-ms-sites-list-table.php (modified) (1 diff)
• network/sites.php (modified) (5 diffs)

trunk/src/wp-admin/includes/class-wp-ms-sites-list-table.php

@@ -502 +502 @@
                         if ( get_current_site()->blog_id != $blog['blog_id'] ) {
                                 if ( $blog['deleted'] == '1' ) {
-                                        $actions['activate']   = '<span class="activate"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=activateblog&amp;id=' . $blog['blog_id'] . '&amp;msg=' . urlencode( sprintf( __( 'You are about to activate the site %s' ), $blogname ) ) ), 'confirm' ) ) . '">' . __( 'Activate' ) . '</a></span>';
+                                        $actions['activate']   = '<span class="activate"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=activateblog&amp;id=' . $blog['blog_id'] ), 'activateblog_' . $blog['blog_id'] ) ) . '">' . __( 'Activate' ) . '</a></span>';
                                 } else {
-                                        $actions['deactivate'] = '<span class="activate"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=deactivateblog&amp;id=' . $blog['blog_id'] . '&amp;msg=' . urlencode( sprintf( __( 'You are about to deactivate the site %s' ), $blogname ) ) ), 'confirm' ) ) . '">' . __( 'Deactivate' ) . '</a></span>';
+                                        $actions['deactivate'] = '<span class="activate"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=deactivateblog&amp;id=' . $blog['blog_id'] ), 'deactivateblog_' . $blog['blog_id'] ) ) . '">' . __( 'Deactivate' ) . '</a></span>';
                                 }
 
                                 if ( $blog['archived'] == '1' ) {
-                                        $actions['unarchive'] = '<span class="archive"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=unarchiveblog&amp;id=' . $blog['blog_id'] . '&amp;msg=' . urlencode( sprintf( __( 'You are about to unarchive the site %s.' ), $blogname ) ) ), 'confirm' ) ) . '">' . __( 'Unarchive' ) . '</a></span>';
+                                        $actions['unarchive'] = '<span class="archive"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=unarchiveblog&amp;id=' . $blog['blog_id'] ), 'unarchiveblog_' . $blog['blog_id'] ) ) . '">' . __( 'Unarchive' ) . '</a></span>';
                                 } else {
-                                        $actions['archive']   = '<span class="archive"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=archiveblog&amp;id=' . $blog['blog_id'] . '&amp;msg=' . urlencode( sprintf( __( 'You are about to archive the site %s.' ), $blogname ) ) ), 'confirm' ) ) . '">' . _x( 'Archive', 'verb; site' ) . '</a></span>';
+                                        $actions['archive']   = '<span class="archive"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=archiveblog&amp;id=' . $blog['blog_id'] ), 'archiveblog_' . $blog['blog_id'] ) ) . '">' . _x( 'Archive', 'verb; site' ) . '</a></span>';
                                 }
 
                                 if ( $blog['spam'] == '1' ) {
-                                        $actions['unspam'] = '<span class="spam"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=unspamblog&amp;id=' . $blog['blog_id'] . '&amp;msg=' . urlencode( sprintf( __( 'You are about to unspam the site %s.' ), $blogname ) ) ), 'confirm' ) ) . '">' . _x( 'Not Spam', 'site' ) . '</a></span>';
+                                        $actions['unspam'] = '<span class="spam"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=unspamblog&amp;id=' . $blog['blog_id'] ), 'unspamblog_' . $blog['blog_id'] ) ) . '">' . _x( 'Not Spam', 'site' ) . '</a></span>';
                                 } else {
-                                        $actions['spam']   = '<span class="spam"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=spamblog&amp;id=' . $blog['blog_id'] . '&amp;msg=' . urlencode( sprintf( __( 'You are about to mark the site %s as spam.' ), $blogname ) ) ), 'confirm' ) ) . '">' . _x( 'Spam', 'site' ) . '</a></span>';
+                                        $actions['spam']   = '<span class="spam"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=spamblog&amp;id=' . $blog['blog_id'] ), 'spamblog_' . $blog['blog_id'] ) ) . '">' . _x( 'Spam', 'site' ) . '</a></span>';
                                 }
 
                                 if ( current_user_can( 'delete_site', $blog['blog_id'] ) ) {
-                                        $actions['delete'] = '<span class="delete"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=deleteblog&amp;id=' . $blog['blog_id'] . '&amp;msg=' . urlencode( sprintf( __( 'You are about to delete the site %s.' ), $blogname ) ) ), 'confirm' ) ) . '">' . __( 'Delete' ) . '</a></span>';
+                                        $actions['delete'] = '<span class="delete"><a href="' . esc_url( wp_nonce_url( network_admin_url( 'sites.php?action=confirm&amp;action2=deleteblog&amp;id=' . $blog['blog_id'] ), 'deleteblog_' . $blog['blog_id'] ) ) . '">' . __( 'Delete' ) . '</a></span>';
                                 }
                         }

trunk/src/wp-admin/network/sites.php

@@ -53 +53 @@
         do_action( 'wpmuadminedit' );
 
+        // A list of valid actions and their associated messaging for confirmation output.
+        $manage_actions = array(
+                'activateblog'   => __( 'You are about to activate the site %s' ),
+                'deactivateblog' => __( 'You are about to deactivate the site %s' ),
+                'unarchiveblog'  => __( 'You are about to unarchive the site %s.' ),
+                'archiveblog'    => __( 'You are about to archive the site %s.' ),
+                'unspamblog'     => __( 'You are about to unspam the site %s.' ),
+                'spamblog'       => __( 'You are about to mark the site %s as spam.' ),
+                'deleteblog'     => __( 'You are about to delete the site %s.' ),
+                'unmatureblog'   => __( 'You are about to mark the site %s as mature.' ),
+                'matureblog'     => __( 'You are about to mark the site %s as not mature.' ),
+                'allblogs'       => '',
+        );
+
         if ( 'confirm' === $_GET['action'] ) {
-                check_admin_referer( 'confirm' );
+                // The action2 parameter contains the action being taken on the site.
+                $site_action = $_GET['action2'];
+
+                if ( ! array_key_exists( $site_action, $manage_actions ) ) {
+                        wp_die( __( 'The requested action is not valid.' ) );
+                }
+
+                // The mature/unmature UI exists only as external code. Check the "confirm" nonce for backward compatibility.
+                if ( 'matureblog' === $site_action || 'unmatureblog' === $site_action ) {
+                        check_admin_referer( 'confirm' );
+                } else {
+                        check_admin_referer( $site_action . '_' . $id );
+                }
 
                 if ( ! headers_sent() ) {
@@ -64 +90 @@
                         wp_die( __( 'You are not allowed to change the current site.' ) );
                 }
+
+                $site_details = get_blog_details( $id );
+                $site_address = untrailingslashit( $site_details->domain . $site_details->path );
 
                 require_once( ABSPATH . 'wp-admin/admin-header.php' );
@@ -69 +98 @@
                         <div class="wrap">
                                 <h1><?php _e( 'Confirm your action' ); ?></h1>
-                                <form action="sites.php?action=<?php echo esc_attr( $_GET['action2'] ) ?>" method="post">
-                                        <input type="hidden" name="action" value="<?php echo esc_attr( $_GET['action2'] ) ?>" />
+                                <form action="sites.php?action=<?php echo esc_attr( $site_action ); ?>" method="post">
+                                        <input type="hidden" name="action" value="<?php echo esc_attr( $site_action ); ?>" />
                                         <input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" />
                                         <input type="hidden" name="_wp_http_referer" value="<?php echo esc_attr( wp_get_referer() ); ?>" />
-                                        <?php wp_nonce_field( $_GET['action2'], '_wpnonce', false ); ?>
-                                        <p><?php echo esc_html( wp_unslash( $_GET['msg'] ) ); ?></p>
+                                        <?php wp_nonce_field( $site_action . '_' . $id, '_wpnonce', false ); ?>
+                                        <p><?php echo sprintf( $manage_actions[ $site_action ], $site_address ); ?></p>
                                         <?php submit_button( __( 'Confirm' ), 'button' ); ?>
                                 </form>
@@ -85 +114 @@
         $updated_action = '';
 
-        $manage_actions = array( 'deleteblog', 'allblogs', 'archiveblog', 'unarchiveblog', 'activateblog', 'deactivateblog', 'unspamblog', 'spamblog', 'unmatureblog', 'matureblog' );
-        if ( in_array( $_GET['action'], $manage_actions ) ) {
+        if ( array_key_exists( $_GET['action'], $manage_actions ) ) {
                 $action = $_GET['action'];
-                if ( 'allblogs' === $action )
+                if ( 'allblogs' === $action ) {
                         $action = 'bulk-sites';
-
-                check_admin_referer( $action );
+                }
+
+                check_admin_referer( $action . '_' . $id );
         }
 
@@ -179 +208 @@
         }
 
-        if ( empty( $updated_action ) && in_array( $_GET['action'], $manage_actions ) )
+        if ( empty( $updated_action ) && array_key_exists( $_GET['action'], $manage_actions ) ) {
                 $updated_action = $_GET['action'];
+        }
 
         if ( ! empty( $updated_action ) ) {