Skip to content

Commit cae7b3b

Browse files
josephscottjosephscott
committed
New 'list_users' cap to provide more controls over listing users vs. editing
users. Apply this new cap to the 'Authors & Users' menu item and 'Users' page in wp-admin. Bump db version to 14139 to pick up the new cap. See #13074 git-svn-id: https://develop.svn.wordpress.org/trunk@14189 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 74cae08 commit cae7b3b

7 files changed

Lines changed: 24 additions & 14 deletions

File tree

‎wp-admin/includes/schema.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -607,6 +607,7 @@ function populate_roles_300() {
607607

608608
if ( !empty( $role ) ) {
609609
$role->add_cap( 'update_core' );
610+
$role->add_cap( 'list_users' );
610611
$role->add_cap( 'remove_users' );
611612
$role->add_cap( 'add_users' );
612613
$role->add_cap( 'promote_users' );

‎wp-admin/includes/template.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1812,7 +1812,7 @@ function user_row( $user_object, $style = '', $role = '', $numposts = 0 ) {
18121812
$short_url = substr( $short_url, 0, 32 ).'...';
18131813
$checkbox = '';
18141814
// Check if the user for this row is editable
1815-
if ( current_user_can( 'edit_user', $user_object->ID ) ) {
1815+
if ( current_user_can( 'list_users', $user_object->ID ) ) {
18161816
// Set up the user editing link
18171817
// TODO: make profile/user-edit determination a separate function
18181818
if ($current_user->ID == $user_object->ID) {
@@ -1824,7 +1824,9 @@ function user_row( $user_object, $style = '', $role = '', $numposts = 0 ) {
18241824

18251825
// Set up the hover actions for this user
18261826
$actions = array();
1827-
$actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
1827+
1828+
if ( current_user_can('edit_user', $user_object->ID) )
1829+
$actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
18281830
if ( !is_multisite() && $current_user->ID != $user_object->ID && current_user_can('delete_user', $user_object->ID) )
18291831
$actions['delete'] = "<a class='submitdelete' href='" . wp_nonce_url("users.php?action=delete&amp;user=$user_object->ID", 'bulk-users') . "'>" . __('Delete') . "</a>";
18301832
if ( is_multisite() && $current_user->ID != $user_object->ID && current_user_can('remove_user', $user_object->ID) )

‎wp-admin/includes/upgrade.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -440,7 +440,7 @@ function upgrade_all() {
440440
if ( $wp_current_db_version < 11958 )
441441
upgrade_290();
442442

443-
if ( $wp_current_db_version < 14138 )
443+
if ( $wp_current_db_version < 14139 )
444444
upgrade_300();
445445

446446
maybe_disable_automattic_widgets();
@@ -1108,14 +1108,14 @@ function upgrade_290() {
11081108
function upgrade_300() {
11091109
global $wp_current_db_version, $wpdb;
11101110

1111-
if ( $wp_current_db_version < 12751 ) {
1111+
if ( $wp_current_db_version < 14139 ) {
11121112
populate_roles_300();
11131113
if ( is_multisite() && is_main_site() && ! defined( 'MULTISITE' ) && get_site_option( 'siteurl' ) === false )
11141114
add_site_option( 'siteurl', '' );
11151115
}
11161116

11171117
// #11866 (Convert the taxonomy children cache into a transient) - Remove old cache.
1118-
if ( $wp_current_db_version < 14138 ) {
1118+
if ( $wp_current_db_version < 14139 ) {
11191119
foreach ( get_taxonomies( array('hierarchical' => true) ) as $taxonomy )
11201120
delete_option($taxonomy . '_children');
11211121
}

‎wp-admin/menu.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -172,14 +172,14 @@ function _add_themes_utility_last() {
172172
}
173173
unset($menu_perms, $update_plugins, $update_count);
174174

175-
if ( current_user_can('edit_users') )
176-
$menu[70] = array( __('Users'), 'edit_users', 'users.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
175+
if ( current_user_can('list_users') )
176+
$menu[70] = array( __('Users'), 'list_users', 'users.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
177177
else
178178
$menu[70] = array( __('Profile'), 'read', 'profile.php', '', 'menu-top menu-icon-users', 'menu-users', 'div' );
179179

180-
if ( current_user_can('edit_users') ) {
180+
if ( current_user_can('list_users') ) {
181181
$_wp_real_parent_file['profile.php'] = 'users.php'; // Back-compat for plugins adding submenus to profile.php.
182-
$submenu['users.php'][5] = array(__('Authors & Users'), 'edit_users', 'users.php');
182+
$submenu['users.php'][5] = array(__('Authors & Users'), 'list_users', 'users.php');
183183
$submenu['users.php'][10] = array(_x('Add New', 'user'), 'create_users', 'user-new.php');
184184

185185
$submenu['users.php'][15] = array(__('Your Profile'), 'read', 'profile.php');

‎wp-admin/users.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
/** WordPress Registration API */
1313
require_once( ABSPATH . WPINC . '/registration.php');
1414

15-
if ( !current_user_can('edit_users') )
15+
if ( !current_user_can('list_users') )
1616
wp_die(__('Cheatin&#8217; uh?'));
1717

1818
$title = __('Users');

‎wp-includes/capabilities.php‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -806,9 +806,16 @@ function map_meta_cap( $cap, $user_id ) {
806806
$caps[] = 'promote_users';
807807
break;
808808
case 'edit_user':
809-
if ( !isset( $args[0] ) || $user_id != $args[0] ) {
810-
$caps[] = 'edit_users';
811-
}
809+
// Allow user to edit itself
810+
if ( isset( $args[0] ) && $user_id == $args[0] )
811+
break;
812+
// Fall through
813+
case 'edit_users':
814+
// If multisite these caps are allowed only for super admins.
815+
if ( is_multisite() && !is_super_admin() )
816+
$caps[] = 'do_not_allow';
817+
else
818+
$caps[] = $cap;
812819
break;
813820
case 'delete_post':
814821
$author_data = get_userdata( $user_id );

‎wp-includes/version.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
*
1616
* @global int $wp_db_version
1717
*/
18-
$wp_db_version = 14138;
18+
$wp_db_version = 14139;
1919

2020
/**
2121
* Holds the TinyMCE version

0 commit comments

Comments
 (0)