Changeset 34963 for trunk/src/wp-admin/includes/class-wp-users-list-table.php

Timestamp:

10/08/2015 09:58:34 PM (9 years ago)

Author:

johnbillion

Message:

On the Users list table, show all the roles of a user in a comma-separated list if they have more than one role. This prevents role obfuscation in situations where a user has had more than one role programmatically assigned to them.

Fixes #22959
Props scribu, JustinSainton, DrewAPicture, johnbillion

File:

• trunk/src/wp-admin/includes/class-wp-users-list-table.php (modified) (7 diffs)

trunk/src/wp-admin/includes/class-wp-users-list-table.php

@@ -325 +325 @@
             $post_counts = count_many_users_posts( array_keys( $this->items ) );
 
-        $editable_roles = array_keys( get_editable_roles() );
-
         foreach ( $this->items as $userid => $user_object ) {
-            if ( count( $user_object->roles ) <= 1 ) {
-                $role = reset( $user_object->roles );
-            } elseif ( $roles = array_intersect( array_values( $user_object->roles ), $editable_roles ) ) {
-                $role = reset( $roles );
-            } else {
-                $role = reset( $user_object->roles );
-            }
-
             if ( is_multisite() && empty( $user_object->allcaps ) )
                 continue;
 
-            echo "\n\t" . $this->single_row( $user_object, $style = '', $role, isset( $post_counts ) ? $post_counts[ $userid ] : 0 );
+            echo "\n\t" . $this->single_row( $user_object, '', '', isset( $post_counts ) ? $post_counts[ $userid ] : 0 );
         }
     }
@@ -347 +337 @@
      *
      * @since 3.1.0
-     * @since 4.2.0 The `$style` argument was deprecated.
+     * @since 4.2.0 The `$style` parameter was deprecated.
+     * @since 4.4.0 The `$role` parameter was deprecated.
      * @access public
      *
      * @param object $user_object The current user object.
      * @param string $style       Deprecated. Not used.
-     * @param string $role        Optional. Key for the $wp_roles array. Default empty.
+     * @param string $role        Deprecated. Not used.
      * @param int    $numposts    Optional. Post count to display for this user. Defaults
      *                            to zero, as in, a new user has made zero posts.
@@ -370 +361 @@
         else
             $url = 'users.php?';
+
+        $user_roles = $this->get_role_list( $user_object );
 
         // Set up the hover actions for this user
@@ -403 +396 @@
             $actions = apply_filters( 'user_row_actions', $actions, $user_object );
 
+            // Role classes.
+            $role_classes = esc_attr( implode( ' ', array_keys( $user_roles ) ) );
+
             // Set up the checkbox ( because the user is editable, otherwise it's empty )
             $checkbox = '<label class="screen-reader-text" for="user_' . $user_object->ID . '">' . sprintf( __( 'Select %s' ), $user_object->user_login ) . '</label>'
-                        . "<input type='checkbox' name='users[]' id='user_{$user_object->ID}' class='$role' value='{$user_object->ID}' />";
+                        . "<input type='checkbox' name='users[]' id='user_{$user_object->ID}' class='{$role_classes}' value='{$user_object->ID}' />";
 
         } else {
@@ -412 +408 @@
         $role_name = isset( $wp_roles->role_names[$role] ) ? translate_user_role( $wp_roles->role_names[$role] ) : __( 'None' );
         $avatar = get_avatar( $user_object->ID, 32 );
+
+        // Comma-separated list of user roles.
+        $roles_list = implode( ', ', $user_roles );
 
         $r = "<tr id='user-$user_object->ID'>";
@@ -449 +448 @@
                         break;
                     case 'role':
-                        $r .= $role_name;
+                        $r .= esc_html( $roles_list );
                         break;
                     case 'posts':
@@ -496 +495 @@
         return 'username';
     }
+
+    /**
+     * Returns an array of user roles for a given user object.
+     *
+     * @since 4.4.0
+     * @access protected
+     *
+     * @param WP_User $user_object The WP_User object.
+     * @return array An array of user roles.
+     */
+    protected function get_role_list( $user_object ) {
+        global $wp_roles;
+
+        $role_list = array();
+
+        foreach ( $user_object->roles as $role ) {
+            if ( isset( $wp_roles->role_names[ $role ] ) ) {
+                $role_list[ $role ] = translate_user_role( $wp_roles->role_names[ $role ] );
+            }
+        }
+
+        if ( empty( $role_list ) ) {
+            $role_list['none'] = _x( 'None', 'no user roles' );
+        }
+
+        /**
+         * Filter the returned array of roles for a user.
+         *
+         * @since 4.4.0
+         *
+         * @param array   $role_list   An array of user roles.
+         * @param WP_User $user_object A WP_User object.
+         */
+        return apply_filters( 'get_role_list', $role_list, $user_object );
+    }
+
 }