Changeset 41268

Timestamp:

08/18/2017 06:30:28 PM (7 years ago)

Author:

flixos90

Message:

Role/Capability: Introduce capabilities dedicated to installing and updating language files.

The new meta capabilities are called install_languages and update_languages. Prior to this change, there were no proper capability checks applied. Instead only the filesystem and related constants were checked, and for actual permissions a rather vague fallback was used where a user needed to have at least one of the other updating capabilities. In addition to being generally more verbose, the new capabilities make it possible for example to allow a user to update languages, but nothing else. By default they fall back to the original way of how they were handled.

Props johnbillion, flixos90.
Fixes #39677.

Location:

trunk

Files:

• src/wp-admin/menu.php (modified) (1 diff)
• src/wp-admin/network/settings.php (modified) (2 diffs)
• src/wp-admin/network/site-new.php (modified) (2 diffs)
• src/wp-admin/options-general.php (modified) (1 diff)
• src/wp-admin/options.php (modified) (1 diff)
• src/wp-admin/update-core.php (modified) (3 diffs)
• src/wp-includes/capabilities.php (modified) (2 diffs)
• src/wp-includes/default-filters.php (modified) (1 diff)
• tests/phpunit/tests/user/capabilities.php (modified) (2 diffs)

trunk/src/wp-admin/menu.php

@@ -34 +34 @@
 
 if ( ! is_multisite() ) {
-    if ( current_user_can( 'update_core' ) )
+    if ( current_user_can( 'update_core' ) ) {
         $cap = 'update_core';
-    elseif ( current_user_can( 'update_plugins' ) )
+    } elseif ( current_user_can( 'update_plugins' ) ) {
         $cap = 'update_plugins';
-    else
+    } elseif ( current_user_can( 'update_themes' ) ) {
         $cap = 'update_themes';
+    } else {
+        $cap = 'update_languages';
+    }
     $submenu[ 'index.php' ][10] = array( sprintf( __('Updates %s'), "<span class='update-plugins count-{$update_data['counts']['total']}'><span class='update-count'>" . number_format_i18n($update_data['counts']['total']) . "</span></span>" ), $cap, 'update-core.php');
     unset( $cap );

trunk/src/wp-admin/network/settings.php

@@ -64 +64 @@
 
     // Handle translation install.
-    if ( ! empty( $_POST['WPLANG'] ) && wp_can_install_language_pack() ) {  // @todo: Skip if already installed
+    if ( ! empty( $_POST['WPLANG'] ) && current_user_can( 'install_languages' ) ) {
         $language = wp_download_language_pack( $_POST['WPLANG'] );
         if ( $language ) {
@@ -343 +343 @@
                             'languages'    => $languages,
                             'translations' => $translations,
-                            'show_available_translations' => wp_can_install_language_pack(),
+                            'show_available_translations' => current_user_can( 'install_languages' ),
                         ) );
                         ?>

trunk/src/wp-admin/network/site-new.php

@@ -67 +67 @@
         if ( '' === $_POST['WPLANG'] ) {
             $meta['WPLANG'] = ''; // en_US
-        } elseif ( wp_can_install_language_pack() ) {
+        } elseif ( in_array( $_POST['WPLANG'], get_available_languages() ) ) {
+            $meta['WPLANG'] = $_POST['WPLANG'];
+        } elseif ( current_user_can( 'install_languages' ) ) {
             $language = wp_download_language_pack( wp_unslash( $_POST['WPLANG'] ) );
             if ( $language ) {
@@ -235 +237 @@
                         'languages'                   => $languages,
                         'translations'                => $translations,
-                        'show_available_translations' => wp_can_install_language_pack(),
+                        'show_available_translations' => current_user_can( 'install_languages' ),
                     ) );
                     ?>

trunk/src/wp-admin/options-general.php

@@ -152 +152 @@
                 'languages'    => $languages,
                 'translations' => $translations,
-                'show_available_translations' => ( ! is_multisite() || is_super_admin() ) && wp_can_install_language_pack(),
+                'show_available_translations' => current_user_can( 'install_languages' ),
             ) );
 

trunk/src/wp-admin/options.php

@@ -178 +178 @@
 
         // Handle translation install.
-        if ( ! empty( $_POST['WPLANG'] ) && ( ! is_multisite() || is_super_admin() ) ) { // @todo: Skip if already installed
+        if ( ! empty( $_POST['WPLANG'] ) && current_user_can( 'install_languages' ) ) {
             require_once( ABSPATH . 'wp-admin/includes/translation-install.php' );
 
-            if ( wp_can_install_language_pack() ) {
-                $language = wp_download_language_pack( $_POST['WPLANG'] );
-                if ( $language ) {
-                    $_POST['WPLANG'] = $language;
-                }
+            $language = wp_download_language_pack( $_POST['WPLANG'] );
+            if ( $language ) {
+                $_POST['WPLANG'] = $language;
             }
         }

trunk/src/wp-admin/update-core.php

@@ -20 +20 @@
 }
 
-if ( ! current_user_can( 'update_core' ) && ! current_user_can( 'update_themes' ) && ! current_user_can( 'update_plugins' ) )
+if ( ! current_user_can( 'update_core' ) && ! current_user_can( 'update_themes' ) && ! current_user_can( 'update_plugins' ) && ! current_user_can( 'update_languages' ) )
     wp_die( __( 'Sorry, you are not allowed to update this site.' ) );
 
@@ -609 +609 @@
     echo '</p>';
 
-    if ( $core = current_user_can( 'update_core' ) )
+    if ( current_user_can( 'update_core' ) ) {
         core_upgrade_preamble();
-    if ( $plugins = current_user_can( 'update_plugins' ) )
+    }
+    if ( current_user_can( 'update_plugins' ) ) {
         list_plugin_updates();
-    if ( $themes = current_user_can( 'update_themes' ) )
+    }
+    if ( current_user_can( 'update_themes' ) ) {
         list_theme_updates();
-    if ( $core || $plugins || $themes )
+    }
+    if ( current_user_can( 'update_languages' ) ) {
         list_translation_updates();
-    unset( $core, $plugins, $themes );
+    }
+
     /**
      * Fires after the core, plugin, and theme update tables.
@@ -730 +734 @@
 } elseif ( 'do-translation-upgrade' == $action ) {
 
-    if ( ! current_user_can( 'update_core' ) && ! current_user_can( 'update_plugins' ) && ! current_user_can( 'update_themes' ) )
+    if ( ! current_user_can( 'update_languages' ) )
         wp_die( __( 'Sorry, you are not allowed to update this site.' ) );
 

trunk/src/wp-includes/capabilities.php

@@ -393 +393 @@
         }
         break;
+    case 'install_languages':
+    case 'update_languages':
+        if ( ! function_exists( 'wp_can_install_language_pack' ) ) {
+            require_once( ABSPATH . 'wp-admin/includes/translation-install.php' );
+        }
+
+        if ( ! wp_can_install_language_pack() ) {
+            $caps[] = 'do_not_allow';
+        } elseif ( is_multisite() && ! is_super_admin( $user_id ) ) {
+            $caps[] = 'do_not_allow';
+        } else {
+            $caps[] = 'install_languages';
+        }
+        break;
     case 'activate_plugins':
         $caps[] = $cap;
@@ -827 +841 @@
     return false;
 }
+
+/**
+ * Filters the user capabilities to grant the 'install_languages' capability as necessary.
+ *
+ * A user must have at least one out of the 'update_core', 'install_plugins', and
+ * 'install_themes' capabilities to qualify for 'install_languages'.
+ *
+ * @since 4.9.0
+ *
+ * @param array $allcaps An array of all the user's capabilities.
+ * @return array Filtered array of the user's capabilities.
+ */
+function wp_maybe_grant_install_languages_cap( $allcaps ) {
+    if ( ! empty( $allcaps['update_core'] ) || ! empty( $allcaps['install_plugins'] ) || ! empty( $allcaps['install_themes'] ) ) {
+        $allcaps['install_languages'] = true;
+    }
+
+    return $allcaps;
+}

trunk/src/wp-includes/default-filters.php

@@ -513 +513 @@
 add_filter( 'pre_oembed_result',      'wp_filter_pre_oembed_result',    10, 3 );
 
+// Capabilities
+add_filter( 'user_has_cap', 'wp_maybe_grant_install_languages_cap', 1 );
+
 unset( $filter, $action );

trunk/tests/phpunit/tests/user/capabilities.php

@@ -234 +234 @@
             'customize'              => array( 'administrator' ),
             'add_users'              => array( 'administrator' ),
+            'install_languages'      => array( 'administrator' ),
+            'update_languages'       => array( 'administrator' ),
 
             'edit_categories'        => array( 'administrator', 'editor' ),
@@ -262 +264 @@
             'edit_css'               => array(),
             'upgrade_network'        => array(),
+            'install_languages'      => array(),
+            'update_languages'       => array(),
 
             'customize'              => array( 'administrator' ),