Changeset 41268 for trunk/src/wp-admin/update-core.php

Timestamp:

08/18/2017 06:30:28 PM (6 years ago)

Author:

flixos90

Message:

Role/Capability: Introduce capabilities dedicated to installing and updating language files.

The new meta capabilities are called install_languages and update_languages. Prior to this change, there were no proper capability checks applied. Instead only the filesystem and related constants were checked, and for actual permissions a rather vague fallback was used where a user needed to have at least one of the other updating capabilities. In addition to being generally more verbose, the new capabilities make it possible for example to allow a user to update languages, but nothing else. By default they fall back to the original way of how they were handled.

Props johnbillion, flixos90.
Fixes #39677.

File:

• trunk/src/wp-admin/update-core.php (modified) (3 diffs)

trunk/src/wp-admin/update-core.php

@@ -20 +20 @@
 }
 
-if ( ! current_user_can( 'update_core' ) && ! current_user_can( 'update_themes' ) && ! current_user_can( 'update_plugins' ) )
+if ( ! current_user_can( 'update_core' ) && ! current_user_can( 'update_themes' ) && ! current_user_can( 'update_plugins' ) && ! current_user_can( 'update_languages' ) )
     wp_die( __( 'Sorry, you are not allowed to update this site.' ) );
 
@@ -609 +609 @@
     echo '</p>';
 
-    if ( $core = current_user_can( 'update_core' ) )
+    if ( current_user_can( 'update_core' ) ) {
         core_upgrade_preamble();
-    if ( $plugins = current_user_can( 'update_plugins' ) )
+    }
+    if ( current_user_can( 'update_plugins' ) ) {
         list_plugin_updates();
-    if ( $themes = current_user_can( 'update_themes' ) )
+    }
+    if ( current_user_can( 'update_themes' ) ) {
         list_theme_updates();
-    if ( $core || $plugins || $themes )
+    }
+    if ( current_user_can( 'update_languages' ) ) {
         list_translation_updates();
-    unset( $core, $plugins, $themes );
+    }
+
     /**
      * Fires after the core, plugin, and theme update tables.
@@ -730 +734 @@
 } elseif ( 'do-translation-upgrade' == $action ) {
 
-    if ( ! current_user_can( 'update_core' ) && ! current_user_can( 'update_plugins' ) && ! current_user_can( 'update_themes' ) )
+    if ( ! current_user_can( 'update_languages' ) )
         wp_die( __( 'Sorry, you are not allowed to update this site.' ) );