Changeset 49270

Timestamp:

10/22/2020 02:34:16 AM (4 years ago)

Author:

TimothyBlynJacobs

Message:

App Passwords: Explain that apps can access to all sites in a network.

Props georgestephanis, spacedmonkey, johnjamesjacoby, SergeyBiryukov, marybaum.
Fixes #51489.

Location:

trunk/src/wp-admin

Files:

• authorize-application.php (modified) (1 diff)
• user-edit.php (modified) (1 diff)

trunk/src/wp-admin/authorize-application.php

@@ -121 +121 @@
             <p><?php _e( 'Would you like to give this application access to your account? You should only do this if you trust the app in question.' ); ?></p>
         <?php endif; ?>
+
+        <?php
+        if ( is_multisite() ) {
+            $blogs = get_blogs_of_user( $user->ID, true );
+            if ( count( $blogs ) > 1 ) {
+                ?>
+                <p>
+                <?php
+                    printf(
+                        /* translators: 1: url to my-sites.php, 2: Number of blogs the user has. */
+                        _n(
+                            'This will grant access to <a href="%1$s">the %2$s blog in this installation that you have permissions on</a>.',
+                            'This will grant access to <a href="%1$s">all %2$s blogs in this installation that you have permissions on</a>.',
+                            count( $blogs )
+                        ),
+                        admin_url( 'my-sites.php' ),
+                        number_format_i18n( count( $blogs ) )
+                    );
+                ?>
+                </p>
+                <?php
+            }
+        }
+        ?>
 
         <?php if ( $new_password ) : ?>

trunk/src/wp-admin/user-edit.php

@@ -716 +716 @@
         <h2><?php _e( 'Application Passwords' ); ?></h2>
         <p><?php _e( 'Application passwords allow authentication via non-interactive systems, such as XML-RPC or the REST API, without providing your actual password. Application passwords can be easily revoked. They cannot be used for traditional logins to your website.' ); ?></p>
+            <?php
+            if ( is_multisite() ) {
+                $blogs = get_blogs_of_user( $user_id, true );
+                if ( count( $blogs ) > 1 ) {
+                    ?>
+                    <p>
+                    <?php
+                    printf(
+                        /* translators: 1: url to my-sites.php, 2: Number of blogs the user has. */
+                        _n(
+                            'Application passwords grant access to <a href="%1$s">the %2$s blog in this installation that you have permissions on</a>.',
+                            'Application passwords grant access to <a href="%1$s">all %2$s blogs in this installation that you have permissions on</a>.',
+                            count( $blogs )
+                        ),
+                        admin_url( 'my-sites.php' ),
+                        number_format_i18n( count( $blogs ) )
+                    );
+                    ?>
+                    </p>
+                    <?php
+                }
+            }
+            ?>
         <div class="create-application-password">
             <label for="new_application_password_name" class="screen-reader-text"><?php _e( 'New Application Password Name' ); ?></label>