class-multiple-user-roles.php — Admin and Site Enhancements (ASE) 9.0.2

admin-site-enhancements / classes / class-multiple-user-roles.php

admin-site-enhancements / classes Last commit date

class-multiple-user-roles.php

172 lines

1	<?php
2
3	namespace ASENHA\Classes;
4
5	/**
6	* Class for Multiple User Roles module
7	*
8	* @since 6.9.5
9	*/
10	class Multiple_User_Roles {
11
12	/**
13	* Add UI to enable multiple user roles selection
14	*
15	* @since 4.8.0
16	*/
17	public function add_multiple_roles_ui( $user ) {
18	// Get user roles that the current user is allowed to edit
19	$roles = get_editable_roles();
20
21	$current_user = wp_get_current_user();
22	$current_user_roles = array_intersect( array_values( $current_user->roles ), array_keys( $roles ) ); // indexed array of role slugs
23
24	// Get the roles of the user being shown / edited / created
25	if ( ! empty( $user->roles ) ) {
26	$user_roles = array_intersect( array_values( $user->roles ), array_keys( $roles ) ); // indexed array of role slugs
27	} else {
28	$user_roles = array();
29	}
30
31	$is_self = (
32	is_object( $user )
33	&& is_object( $current_user )
34	&& isset( $user->ID )
35	&& isset( $current_user->ID )
36	&& (int) $user->ID === (int) $current_user->ID
37	);
38	$user_is_administrator = is_object( $user ) && in_array( 'administrator', (array) $user->roles, true );
39
40	// Only show roles checkboxes for users that can assign roles to other users
41	if ( current_user_can( 'promote_users', get_current_user_id() ) ) {
42
43	?>
44	<div class="asenha-roles-temporary-container">
45	<table class="form-table">
46	<tr class="asenha-multiple-roles-row">
47	<th>
48	<label>Roles</label>
49	</th>
50	<td>
51	<?php
52	foreach ( $roles as $role_slug => $role_info ) {
53
54	$checkbox_id = $role_slug . '_role';
55	$role_name = translate_user_role( $role_info['name'] );
56	if ( ! empty( $user_roles ) && in_array( $role_slug, $user_roles ) ) {
57	$checked = 'checked="checked"';
58	} else {
59	$checked = '';
60	}
61
62	// On own profile: lock Administrator checkbox. Only emit a hidden retain field when
63	// the user already has administrator — never force-grant it to non-admins.
64	$disabled = '';
65	$lock_own_administrator = false;
66
67	if ( 'administrator' === $role_slug && $is_self ) {
68	$disabled = 'disabled ';
69	if ( $user_is_administrator ) {
70	$lock_own_administrator = true;
71	}
72	}
73
74	// Output roles checkboxes
75	?>
76	<label for="<?php esc_attr_e( $checkbox_id ); ?>"><input type="checkbox" id="<?php esc_attr_e( $checkbox_id ); ?>" value="<?php esc_attr_e( $role_slug ); ?>" name="asenha_assigned_roles[]" <?php esc_attr_e( $checked ); ?> <?php esc_attr_e( $disabled ); ?>/> <?php esc_html_e( $role_name ); ?></label><br />
77	<?php
78	if ( $lock_own_administrator ) {
79	?>
80	<input type="hidden" name="asenha_assigned_roles[]" value="administrator" />
81	<?php
82	}
83
84	}
85
86	wp_nonce_field( 'asenha_set_multiple_roles', 'asenha_multiple_roles_nonce' );
87
88	?>
89	</td>
90	</tr>
91	</table>
92	</div>
93	<?php
94
95	}
96
97	}
98
99	/**
100	* Save changes in roles assignment
101	*
102	* @since 4.8.0
103	*/
104	public function save_roles_assignment( $user_id ) {
105
106	if ( ! isset( $_POST['asenha_multiple_roles_nonce'] ) ) {
107	return;
108	}
109
110	if ( ! current_user_can( 'promote_users', get_current_user_id() ) \|\| ! wp_verify_nonce( $_POST['asenha_multiple_roles_nonce'], 'asenha_set_multiple_roles' ) ) {
111	return;
112	}
113
114	// Get user roles that the current user is allowed to edit
115	$roles = get_editable_roles();
116
117	$current_user = wp_get_current_user();
118	$current_user_roles = array_intersect( array_values( $current_user->roles ), array_keys( $roles ) ); // indexed array of role slugs
119
120	// Get the roles of the user being shown / edited / created
121	$user = get_user_by( 'id', (int) $user_id ); // WP_User object
122
123	if ( ! $user ) {
124	return;
125	}
126
127	$user_roles = array_intersect( array_values( $user->roles ), array_keys( $roles ) ); // Current/existing roles
128
129	$assigned_roles = array();
130
131	if ( isset( $_POST['asenha_assigned_roles'] ) && is_array( $_POST['asenha_assigned_roles'] ) ) {
132	$assigned_roles = array_map( 'sanitize_text_field', wp_unslash( $_POST['asenha_assigned_roles'] ) );
133	}
134
135	// Make sure only valid roles are processed
136	$assigned_roles = array_intersect( $assigned_roles, array_keys( $roles ) );
137
138	// Self-edit: retain administrator only if already held; otherwise strip it
139	// so non-admins with promote_users cannot self-escalate via POST.
140	$is_self = ( (int) $user->ID === (int) $current_user->ID );
141	$user_is_administrator = in_array( 'administrator', (array) $user->roles, true );
142
143	if ( $is_self ) {
144	if ( $user_is_administrator ) {
145	$assigned_roles[] = 'administrator';
146	$assigned_roles = array_unique( $assigned_roles );
147	} else {
148	$assigned_roles = array_values( array_diff( $assigned_roles, array( 'administrator' ) ) );
149	}
150	}
151
152	// Identify and remove roles not present in the newly assigned roles
153	$roles_to_remove = array_diff( $user_roles, $assigned_roles );
154
155	if ( ! empty( $roles_to_remove ) ) {
156	foreach ( $roles_to_remove as $role_to_remove ) {
157	$user->remove_role( $role_to_remove );
158	}
159	}
160
161	// Identify and add roles not present in the existing roles
162	$roles_to_add = array_diff( $assigned_roles, $user_roles );
163
164	if ( ! empty( $roles_to_add ) ) {
165	foreach ( $roles_to_add as $role_to_add ) {
166	$user->add_role( $role_to_add );
167	}
168	}
169
170	}
171
172	}