sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Replace check_permissions() with ajax_user_can(). New method returns true/false to current_user_can(), which we then handle in admin ajax. see #15326.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@16992 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin 2010-12-16 09:18:28 +00:00
parent 8661cbc56e
commit 266cd3f5df
15 changed files with 47 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
wp-admin/admin-ajax.php
View File

@ -61,7 +61,9 @@ case 'fetch-list' :
if ( ! $wp_list_table )
die( '0' );
$wp_list_table->check_permissions();
if ( ! $wp_list_table->ajax_user_can() )
die( '-1' );
$wp_list_table->ajax_response();
die( '0' );
@ -1200,12 +1202,18 @@ case 'inline-save':
case 'inline-save-tax':
check_ajax_referer( 'taxinlineeditnonce', '_inline_edit' );
set_current_screen( 'edit-' . $_POST['taxonomy'] );
$taxonomy = sanitize_key( $_POST['taxonomy'] );
$tax = get_taxonomy( $taxonomy );
if ( ! $tax )
die( '0' );
if ( ! current_user_can( $tax->cap->edit_terms ) )
die( '-1' );
set_current_screen( 'edit-' . $taxonomy );
$wp_list_table = get_list_table('WP_Terms_List_Table');
$wp_list_table->check_permissions('edit');
if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) )
die(-1);

5
wp-admin/includes/class-wp-comments-list-table.php
View File

@ -33,9 +33,8 @@ class WP_Comments_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
if ( !current_user_can('edit_posts') )
wp_die(__('Cheatin’ uh?'));
function ajax_user_can() {
return current_user_can('edit_posts');
}
function prepare_items() {

5
wp-admin/includes/class-wp-links-list-table.php
View File

@ -14,9 +14,8 @@ class WP_Links_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
if ( ! current_user_can( 'manage_links' ) )
wp_die( __( 'You do not have sufficient permissions to edit the links for this site.' ) );
function ajax_user_can() {
return current_user_can( 'manage_links' );
}
function prepare_items() {

4
wp-admin/includes/class-wp-list-table.php
View File

@ -105,8 +105,8 @@ class WP_List_Table {
* @since 3.1.0
* @access public
*/
function check_permissions() {
die( 'function WP_List_Table::check_permissions() must be over-ridden in a sub-class.' );
function ajax_user_can() {
die( 'function WP_List_Table::ajax_user_can() must be over-ridden in a sub-class.' );
}
/**

5
wp-admin/includes/class-wp-media-list-table.php
View File

@ -16,9 +16,8 @@ class WP_Media_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
if ( !current_user_can('upload_files') )
wp_die( __( 'You do not have permission to upload files.' ) );
function ajax_user_can() {
return current_user_can('upload_files');
}
function prepare_items() {

5
wp-admin/includes/class-wp-ms-sites-list-table.php
View File

@ -14,9 +14,8 @@ class WP_MS_Sites_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
if ( ! current_user_can( 'manage_sites' ) )
wp_die( __( 'You do not have permission to access this page.' ) );
function ajax_user_can() {
return current_user_can( 'manage_sites' );
}
function prepare_items() {

9
wp-admin/includes/class-wp-ms-themes-list-table.php
View File

@ -36,16 +36,17 @@ class WP_MS_Themes_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
function ajax_user_can() {
$menu_perms = get_site_option( 'menu_items', array() );
if ( empty( $menu_perms['themes'] ) && ! is_super_admin() )
wp_die( __( 'Cheatin’ uh?' ) );
return false;
if ( $this->is_site_themes && !current_user_can('manage_sites') )
wp_die( __( 'You do not have sufficient permissions to manage themes for this site.' ) );
return false;
elseif ( !$this->is_site_themes && !current_user_can('manage_network_themes') )
wp_die( __( 'You do not have sufficient permissions to manage network themes.' ) );
return false;
return true;
}
function prepare_items() {

5
wp-admin/includes/class-wp-ms-users-list-table.php
View File

@ -8,9 +8,8 @@
*/
class WP_MS_Users_List_Table extends WP_List_Table {
function check_permissions() {
if ( ! current_user_can( 'manage_network_users' ) )
wp_die( __( 'You do not have permission to access this page.' ) );
function ajax_user_can() {
return current_user_can( 'manage_network_users' );
}
function prepare_items() {

5
wp-admin/includes/class-wp-plugin-install-list-table.php
View File

@ -8,9 +8,8 @@
*/
class WP_Plugin_Install_List_Table extends WP_List_Table {
function check_permissions() {
if ( ! current_user_can('install_plugins') )
wp_die(__('You do not have sufficient permissions to install plugins on this site.'));
function ajax_user_can() {
return current_user_can('install_plugins');
}
function prepare_items() {

7
wp-admin/includes/class-wp-plugins-list-table.php
View File

@ -27,16 +27,15 @@ class WP_Plugins_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
function ajax_user_can() {
if ( is_multisite() ) {
$menu_perms = get_site_option( 'menu_items', array() );
if ( empty( $menu_perms['plugins'] ) && ! is_super_admin() )
wp_die( __( 'Cheatin’ uh?' ) );
return false;
}
if ( !current_user_can('activate_plugins') )
wp_die( __( 'You do not have sufficient permissions to manage plugins for this site.' ) );
return current_user_can('activate_plugins');
}
function prepare_items() {

5
wp-admin/includes/class-wp-posts-list-table.php
View File

@ -78,11 +78,10 @@ class WP_Posts_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
function ajax_user_can() {
global $post_type_object;
if ( !current_user_can( $post_type_object->cap->edit_posts ) )
wp_die( __( 'Cheatin’ uh?' ) );
return current_user_can( $post_type_object->cap->edit_posts );
}
function prepare_items() {

6
wp-admin/includes/class-wp-terms-list-table.php
View File

@ -32,12 +32,10 @@ class WP_Terms_List_Table extends WP_List_Table {
) );
}
function check_permissions( $type = '' ) {
function ajax_user_can() {
global $tax;
$cap = 'edit' == $type ? $tax->cap->edit_terms : $tax->cap->manage_terms;
if ( !current_user_can( $cap ) )
wp_die( __( 'Cheatin’ uh?' ) );
return current_user_can( $tax->cap->manage_terms );
}
function prepare_items() {

5
wp-admin/includes/class-wp-theme-install-list-table.php
View File

@ -8,9 +8,8 @@
*/
class WP_Theme_Install_List_Table extends WP_List_Table {
function check_permissions() {
if ( ! current_user_can('install_themes') )
wp_die( __( 'You do not have sufficient permissions to install themes on this site.' ) );
function ajax_user_can() {
return current_user_can('install_themes');
}
function prepare_items() {

5
wp-admin/includes/class-wp-themes-list-table.php
View File

@ -11,10 +11,9 @@ class WP_Themes_List_Table extends WP_List_Table {
var $search = array();
var $features = array();
function check_permissions() {
function ajax_user_can() {
// Do not check edit_theme_options here. AJAX calls for available themes require switch_themes.
if ( !current_user_can('switch_themes') )
wp_die( __( 'Cheatin’ uh?' ) );
return current_user_can('switch_themes');
}
function prepare_items() {

11
wp-admin/includes/class-wp-users-list-table.php
View File

@ -24,12 +24,11 @@ class WP_Users_List_Table extends WP_List_Table {
) );
}
function check_permissions() {
if ( ! $this->is_site_users && ! current_user_can( 'list_users' ) )
wp_die( __( 'Cheatin’ uh?' ) );
if ( $this->is_site_users && ! current_user_can( 'manage_sites' ) )
wp_die(__( 'You do not have sufficient permissions to edit this site.' ) );
function ajax_user_can() {
if ( $this->is_site_users )
return current_user_can( 'manage_sites' );
else
return current_user_can( 'list_users' );
}
function prepare_items() {