WordPress.org

Make WordPress Core

Changeset 34963


Ignore:
Timestamp:
10/08/2015 09:58:34 PM (3 years ago)
Author:
johnbillion
Message:

On the Users list table, show all the roles of a user in a comma-separated list if they have more than one role. This prevents role obfuscation in situations where a user has had more than one role programmatically assigned to them.

Fixes #22959
Props scribu, JustinSainton, DrewAPicture, johnbillion

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/includes/class-wp-users-list-table.php

    r34813 r34963  
    325325            $post_counts = count_many_users_posts( array_keys( $this->items ) );
    326326
    327         $editable_roles = array_keys( get_editable_roles() );
    328 
    329327        foreach ( $this->items as $userid => $user_object ) {
    330             if ( count( $user_object->roles ) <= 1 ) {
    331                 $role = reset( $user_object->roles );
    332             } elseif ( $roles = array_intersect( array_values( $user_object->roles ), $editable_roles ) ) {
    333                 $role = reset( $roles );
    334             } else {
    335                 $role = reset( $user_object->roles );
    336             }
    337 
    338328            if ( is_multisite() && empty( $user_object->allcaps ) )
    339329                continue;
    340330
    341             echo "\n\t" . $this->single_row( $user_object, $style = '', $role, isset( $post_counts ) ? $post_counts[ $userid ] : 0 );
     331            echo "\n\t" . $this->single_row( $user_object, '', '', isset( $post_counts ) ? $post_counts[ $userid ] : 0 );
    342332        }
    343333    }
     
    347337     *
    348338     * @since 3.1.0
    349      * @since 4.2.0 The `$style` argument was deprecated.
     339     * @since 4.2.0 The `$style` parameter was deprecated.
     340     * @since 4.4.0 The `$role` parameter was deprecated.
    350341     * @access public
    351342     *
    352343     * @param object $user_object The current user object.
    353344     * @param string $style       Deprecated. Not used.
    354      * @param string $role        Optional. Key for the $wp_roles array. Default empty.
     345     * @param string $role        Deprecated. Not used.
    355346     * @param int    $numposts    Optional. Post count to display for this user. Defaults
    356347     *                            to zero, as in, a new user has made zero posts.
     
    370361        else
    371362            $url = 'users.php?';
     363
     364        $user_roles = $this->get_role_list( $user_object );
    372365
    373366        // Set up the hover actions for this user
     
    403396            $actions = apply_filters( 'user_row_actions', $actions, $user_object );
    404397
     398            // Role classes.
     399            $role_classes = esc_attr( implode( ' ', array_keys( $user_roles ) ) );
     400
    405401            // Set up the checkbox ( because the user is editable, otherwise it's empty )
    406402            $checkbox = '<label class="screen-reader-text" for="user_' . $user_object->ID . '">' . sprintf( __( 'Select %s' ), $user_object->user_login ) . '</label>'
    407                         . "<input type='checkbox' name='users[]' id='user_{$user_object->ID}' class='$role' value='{$user_object->ID}' />";
     403                        . "<input type='checkbox' name='users[]' id='user_{$user_object->ID}' class='{$role_classes}' value='{$user_object->ID}' />";
    408404
    409405        } else {
     
    412408        $role_name = isset( $wp_roles->role_names[$role] ) ? translate_user_role( $wp_roles->role_names[$role] ) : __( 'None' );
    413409        $avatar = get_avatar( $user_object->ID, 32 );
     410
     411        // Comma-separated list of user roles.
     412        $roles_list = implode( ', ', $user_roles );
    414413
    415414        $r = "<tr id='user-$user_object->ID'>";
     
    449448                        break;
    450449                    case 'role':
    451                         $r .= $role_name;
     450                        $r .= esc_html( $roles_list );
    452451                        break;
    453452                    case 'posts':
     
    496495        return 'username';
    497496    }
     497
     498    /**
     499     * Returns an array of user roles for a given user object.
     500     *
     501     * @since 4.4.0
     502     * @access protected
     503     *
     504     * @param WP_User $user_object The WP_User object.
     505     * @return array An array of user roles.
     506     */
     507    protected function get_role_list( $user_object ) {
     508        global $wp_roles;
     509
     510        $role_list = array();
     511
     512        foreach ( $user_object->roles as $role ) {
     513            if ( isset( $wp_roles->role_names[ $role ] ) ) {
     514                $role_list[ $role ] = translate_user_role( $wp_roles->role_names[ $role ] );
     515            }
     516        }
     517
     518        if ( empty( $role_list ) ) {
     519            $role_list['none'] = _x( 'None', 'no user roles' );
     520        }
     521
     522        /**
     523         * Filter the returned array of roles for a user.
     524         *
     525         * @since 4.4.0
     526         *
     527         * @param array   $role_list   An array of user roles.
     528         * @param WP_User $user_object A WP_User object.
     529         */
     530        return apply_filters( 'get_role_list', $role_list, $user_object );
     531    }
     532
    498533}
Note: See TracChangeset for help on using the changeset viewer.