Changeset 42202

Timestamp:

11/17/2017 09:34:01 PM (7 years ago)

Author:

flixos90

Message:

Multisite: Do not show edit links in network users table for users that cannot be edited.

Props ocean90.
Fixes #42552.

File:

• trunk/src/wp-admin/includes/class-wp-ms-users-list-table.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-ms-users-list-table.php

@@ -234 +234 @@
         $super_admins = get_super_admins();
         $avatar = get_avatar( $user->user_email, 32 );
-        $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );
 
         echo $avatar;
 
-        ?><strong><a href="<?php echo $edit_link; ?>" class="edit"><?php echo $user->user_login; ?></a><?php
-        if ( in_array( $user->user_login, $super_admins ) ) {
-            echo ' &mdash; ' . __( 'Super Admin' );
-        }
-        ?></strong>
-    <?php
+        if ( current_user_can( 'edit_user', $user->ID ) ) {
+            $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );
+            $edit = "<a href=\"{$edit_link}\">{$user->user_login}</a>";
+        } else {
+            $edit = $user->user_login;
+        }
+
+        ?>
+        <strong>
+            <?php
+            echo $edit;
+
+            if ( in_array( $user->user_login, $super_admins ) ) {
+                echo ' &mdash; ' . __( 'Super Admin' );
+            }
+            ?>
+        </strong>
+        <?php
     }
 
@@ -430 +441 @@
 
         $super_admins = get_super_admins();
-        $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );
 
         $actions = array();
-        $actions['edit'] = '<a href="' . $edit_link . '">' . __( 'Edit' ) . '</a>';
+
+        if ( current_user_can( 'edit_user', $user->ID ) ) {
+            $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );
+            $actions['edit'] = '<a href="' . $edit_link . '">' . __( 'Edit' ) . '</a>';
+        }
 
         if ( current_user_can( 'delete_user', $user->ID ) && ! in_array( $user->user_login, $super_admins ) ) {