Changeset 40940

Timestamp:

06/25/2017 06:45:33 PM (9 years ago)

Author:

johnbillion

Message:

Users: Use more appropriate HTTP status codes for errors relating to user management.

Also re-uses one error message string.

Props tuanmh

Fixes #40230

Location:

trunk/src/wp-admin

Files:

• includes/user.php (modified) (1 diff)
• network/site-users.php (modified) (3 diffs)
• users.php (modified) (10 diffs)

trunk/src/wp-admin/includes/user.php

@@ -60 +60 @@
                 $editable_roles = get_editable_roles();
                 if ( ! empty( $new_role ) && empty( $editable_roles[$new_role] ) )
-                        wp_die(__('You can’t give users that role.'));
+                        wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );
         }
 

trunk/src/wp-admin/network/site-users.php

@@ -12 +12 @@
 
 if ( ! current_user_can('manage_sites') )
-        wp_die(__('Sorry, you are not allowed to edit this site.'));
+        wp_die( __( 'Sorry, you are not allowed to edit this site.' ), 403 );
 
 $wp_list_table = _get_list_table('WP_Users_List_Table');
@@ -116 +116 @@
                 case 'remove':
                         if ( ! current_user_can( 'remove_users' ) ) {
-                                wp_die( __( 'Sorry, you are not allowed to remove users.' ) );
+                                wp_die( __( 'Sorry, you are not allowed to remove users.' ), 403 );
                         }
 
@@ -147 +147 @@
 
                         if ( empty( $editable_roles[ $role ] ) ) {
-                                wp_die( __( 'Sorry, you are not allowed to give users that role.' ) );
+                                wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );
                         }
 

trunk/src/wp-admin/users.php

@@ -95 +95 @@
 
         if ( ! current_user_can( 'promote_users' ) )
-                wp_die( __( 'Sorry, you are not allowed to edit this user.' ) );
+                wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 );
 
         if ( empty($_REQUEST['users']) ) {
@@ -111 +111 @@
 
         if ( ! $role || empty( $editable_roles[ $role ] ) ) {
-                wp_die( __( 'Sorry, you are not allowed to give users that role.' ) );
+                wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );
         }
 
@@ -120 +120 @@
 
                 if ( ! current_user_can('promote_user', $id) )
-                        wp_die(__('Sorry, you are not allowed to edit this user.'));
+                        wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 );
                 // The new role of the current user must also have the promote_users cap or be a multisite super admin
                 if ( $id == $current_user->ID && ! $wp_roles->role_objects[ $role ]->has_cap('promote_users')
@@ -146 +146 @@
 case 'dodelete':
         if ( is_multisite() )
-                wp_die( __('User deletion is not allowed from this screen.') );
+                wp_die( __('User deletion is not allowed from this screen.'), 400 );
 
         check_admin_referer('delete-users');
@@ -165 +165 @@
 
         if ( ! current_user_can( 'delete_users' ) )
-                wp_die(__('Sorry, you are not allowed to delete users.'));
+                wp_die( __( 'Sorry, you are not allowed to delete users.' ), 403 );
 
         $update = 'del';
@@ -172 +172 @@
         foreach ( $userids as $id ) {
                 if ( ! current_user_can( 'delete_user', $id ) )
-                        wp_die(__( 'Sorry, you are not allowed to delete that user.' ) );
+                        wp_die( __( 'Sorry, you are not allowed to delete that user.' ), 403 );
 
                 if ( $id == $current_user->ID ) {
@@ -195 +195 @@
 case 'delete':
         if ( is_multisite() )
-                wp_die( __('User deletion is not allowed from this screen.') );
+                wp_die( __('User deletion is not allowed from this screen.'), 400 );
 
         check_admin_referer('bulk-users');
@@ -307 +307 @@
 
         if ( ! is_multisite() )
-                wp_die( __( 'You can’t remove users.' ) );
+                wp_die( __( 'You can’t remove users.' ), 400 );
 
         if ( empty($_REQUEST['users']) ) {
@@ -315 +315 @@
 
         if ( ! current_user_can( 'remove_users' ) )
-                wp_die( __( 'Sorry, you are not allowed to remove users.' ) );
+                wp_die( __( 'Sorry, you are not allowed to remove users.' ), 403 );
 
         $userids = $_REQUEST['users'];
@@ -338 +338 @@
 
         if ( ! is_multisite() )
-                wp_die( __( 'You can’t remove users.' ) );
+                wp_die( __( 'You can’t remove users.' ), 400 );
 
         if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) {