diff --git a/src/wp-admin/user-edit.php b/src/wp-admin/user-edit.php index 6099904941..fbb1827e50 100644 --- a/src/wp-admin/user-edit.php +++ b/src/wp-admin/user-edit.php @@ -74,9 +74,26 @@ function use_ssl_preference($user) { ID && ! apply_filters( 'enable_edit_any_user_configuration', true ) ) +/** + * Filter whether to allow administrators on Multisite to edit every user. + * + * Enabling the user editing form via this filter also hinges on the user holding + * the 'manage_network_users' cap, and the logged-in user not matching the user + * profile open for editing. + * + * The filter was introduced to replace the EDIT_ANY_USER constant. + * + * @since 3.0.0 + * + * @param bool $allow Whether to allow editing of any user. Default true. + */ +if ( is_multisite() + && ! current_user_can( 'manage_network_users' ) + && $user_id != $current_user->ID + && ! apply_filters( 'enable_edit_any_user_configuration', true ) +) { wp_die( __( 'You do not have permission to edit this user.' ) ); +} // Execute confirmed email change. See send_confirmation_on_profile_email(). if ( is_multisite() && IS_PROFILE_PAGE && isset( $_GET[ 'newuseremail' ] ) && $current_user->ID ) { @@ -106,10 +123,27 @@ check_admin_referer('update-user_' . $user_id); if ( !current_user_can('edit_user', $user_id) ) wp_die(__('You do not have permission to edit this user.')); -if ( IS_PROFILE_PAGE ) - do_action('personal_options_update', $user_id); -else - do_action('edit_user_profile_update', $user_id); +if ( IS_PROFILE_PAGE ) { + /** + * Fires before the page loads on the 'Your Profile' editing screen. + * + * The action only fires if the current user is editing their own profile. + * + * @since 2.0.0 + * + * @param int $user_id The user ID. + */ + do_action( 'personal_options_update', $user_id ); +} else { + /** + * Fires before the page loads on the 'Edit User' screen. + * + * @since 2.7.0 + * + * @param int $user_id The user ID. + */ + do_action( 'edit_user_profile_update', $user_id ); +} if ( !is_multisite() ) { $errors = edit_user($user_id); @@ -188,8 +222,14 @@ if ( ! IS_PROFILE_PAGE ) { - -
> + +> @@ -211,6 +251,16 @@ if ( ! IS_PROFILE_PAGE ) { 1 && has_action('admin_color_scheme_picker') ) : ?> + - +

@@ -353,7 +422,19 @@ if ( is_multisite() && is_network_admin() && ! IS_PROFILE_PAGE && current_user_c foreach ( wp_get_user_contact_methods( $profileuser ) as $name => $desc ) { ?> - + + @@ -396,13 +478,45 @@ if ( $show_password_fields ) : -caps ) > count( $profileuser->roles ) && apply_filters( 'additional_capabilities_display', true, $profileuser ) ) : ?> +caps ) > count( $profileuser->roles ) + && apply_filters( 'additional_capabilities_display', true, $profileuser ) +) : ?>

diff --git a/src/wp-admin/user-new.php b/src/wp-admin/user-new.php index 60d63b2fd3..b7c41b1cc7 100644 --- a/src/wp-admin/user-new.php +++ b/src/wp-admin/user-new.php @@ -117,11 +117,11 @@ Please click the following link to confirm the invite: $add_user_errors = $user_details[ 'errors' ]; } else { /** - * Filter the user_login, aka the username, before it is added to the site. + * Filter the user_login, also known as the username, before it is added to the site. * - * @since 3.0.0 + * @since 2.0.3 * - * @param string $_REQUEST['user_login'] The sanitized username. + * @param string $user_login The sanitized username. */ $new_user_login = apply_filters( 'pre_user_login', sanitize_user( wp_unslash( $_REQUEST['user_login'] ), true ) ); if ( isset( $_POST[ 'noconfirmation' ] ) && is_super_admin() ) { @@ -189,11 +189,11 @@ wp_enqueue_script('wp-ajax-response'); wp_enqueue_script('user-profile'); /** - * Allows you to enable user auto-complete for non-super admins in multisite. + * Filter whether to enable user auto-complete for non-super admins in Multisite. * * @since 3.4.0 * - * @param bool True or false, based on if you enable auto-complete for non-super admins. Default is false. + * @param bool $enable Whether to enable auto-complete for non-super admins. Default false. */ if ( is_multisite() && current_user_can( 'promote_users' ) && ! wp_is_large_network( 'users' ) && ( is_super_admin() || apply_filters( 'autocomplete_users_for_site_admins', false ) ) @@ -287,7 +287,7 @@ if ( is_multisite() ) { * @since 3.0.0 */ ?> -> +> @@ -320,7 +320,7 @@ if ( is_multisite() ) { * * @since 3.7.0 * - * @param string A contextual string specifying which type of new user form the hook follows. + * @param string $type A contextual string specifying which type of new user form the hook follows. */ do_action( 'user_new_form', 'add-existing-user' ); ?> @@ -334,10 +334,8 @@ if ( current_user_can( 'create_users') ) { echo '

' . __( 'Add New User' ) . '

'; ?>

- -> + +> 'login', 'first_name' => 'firstname', 'last_nam * * @since 1.5.1 * - * @param bool True or false, based on if you want to show the password fields. Default is true. + * @param bool $show Whether to show the password fields. Default true. */ if ( apply_filters( 'show_password_fields', true ) ) : ?> diff --git a/src/wp-includes/user.php b/src/wp-includes/user.php index 61768b76d2..3bc29e14af 100644 --- a/src/wp-includes/user.php +++ b/src/wp-includes/user.php @@ -1564,7 +1564,7 @@ function wp_get_user_contact_methods( $user = null ) { * @since 2.9.0 * * @param array $methods Array of contact methods and their labels. - * @param WP_User $user Optional. WP_User object. + * @param WP_User $user WP_User object. */ return apply_filters( 'user_contactmethods', $methods, $user ); }