Changeset 4049

Timestamp:

07/26/2006 10:18:36 PM (18 years ago)

Author:

ryan

Message:

Menu and plugin tweakage.

Location:

trunk

Files:

• wp-admin/admin-functions.php (modified) (4 diffs)
• wp-admin/admin.php (modified) (2 diffs)
• wp-content/plugins/wp-db-backup.php (modified) (2 diffs)
• xmlrpc.php (modified) (1 diff)

trunk/wp-admin/admin-functions.php

@@ -380 +380 @@
         global $current_user, $wp_roles;
         $user_id = func_get_arg(0);
+
         if (isset ($_POST['role'])) {
             if($user_id != $current_user->id || $wp_roles->role_objects[$_POST['role']]->has_cap('edit_users')) {
@@ -413 +414 @@
         $pass2 = $_POST['pass2'];
 
-    if (isset ($_POST['role'])) {
+    if (isset ($_POST['role']) && current_user_can('edit_users')) { 
         if($user_id != $current_user->id || $wp_roles->role_objects[$_POST['role']]->has_cap('edit_users'))
             $user->role = $_POST['role'];
@@ -1331 +1332 @@
     global $submenu;
     global $menu_nopriv;
+    global $plugin_page;
 
     $parent = get_admin_page_parent();
@@ -1337 +1339 @@
         return false;
 
+    if ( isset($plugin_page) && isset($menu_nopriv[$plugin_page]) )
+        return false;
+    
     if ( empty($parent) )
         return true;

trunk/wp-admin/admin.php

@@ -31 +31 @@
 $editing = false;
 
+if (isset($_GET['page'])) {
+    $plugin_page = stripslashes($_GET['page']);
+    $plugin_page = plugin_basename($plugin_page);
+}
+
 require(ABSPATH . '/wp-admin/menu.php');
 
 // Handle plugin admin pages.
-if (isset($_GET['page'])) {
-    $plugin_page = stripslashes($_GET['page']);
-    $plugin_page = plugin_basename($plugin_page);
+if (isset($plugin_page)) {
     $page_hook = get_plugin_page_hook($plugin_page, $pagenow);
 
@@ -64 +67 @@
 
     $importer = $_GET['import'];
+
+    if ( ! current_user_can('import') )
+        wp_die(__('You are not allowed to import.'));
 
     if ( validate_file($importer) ) {

trunk/wp-content/plugins/wp-db-backup.php

@@ -323 +323 @@
     ///////////////////////////////
     function admin_menu() {
-        add_management_page(__('Backup'), __('Backup'), 9, basename(__FILE__), array(&$this, 'backup_menu'));
+        add_management_page(__('Backup'), __('Backup'), 'import', basename(__FILE__), array(&$this, 'backup_menu'));
     }
 
     function fragment_menu() {
-        add_management_page(__('Backup'), __('Backup'), 9, basename(__FILE__), array(&$this, 'build_backup_script'));
+        add_management_page(__('Backup'), __('Backup'), 'import', basename(__FILE__), array(&$this, 'build_backup_script'));
     }
 
@@ -885 +885 @@
 function wpdbBackup_init() {
     global $mywpdbbackup;
+
+    if ( !current_user_can('import') ) return;
+
     $mywpdbbackup = new wpdbBackup();   
 }

trunk/xmlrpc.php

@@ -1229 +1229 @@
         $original_title = $title;
 
-        $comment_post_ID = $post_ID;
+        $comment_post_ID = (int) $post_ID;
         $comment_author = $title;
+        $this->escape($comment_author);
         $comment_author_url = $pagelinkedfrom;
         $comment_content = $context;
+        $this->escape($comment_content);
         $comment_type = 'pingback';