| 1 |
<?php |
| 2 |
/** |
| 3 |
* @package FireBox |
| 4 |
* @version 3.1.11 Free |
| 5 |
* |
| 6 |
* @author FirePlugins <info@fireplugins.com> |
| 7 |
* @link https://www.fireplugins.com |
| 8 |
* @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| 9 |
* @license GNU GPLv3 <http://www.gnu.org/licenses/gpl.html> or later |
| 10 |
*/ |
| 11 |
|
| 12 |
namespace FireBox\Core\Admin; |
| 13 |
|
| 14 |
if (!defined('ABSPATH')) |
| 15 |
{ |
| 16 |
exit; // Exit if accessed directly. |
| 17 |
} |
| 18 |
|
| 19 |
class Capabilities |
| 20 |
{ |
| 21 |
public function __construct() |
| 22 |
{ |
| 23 |
$this->setup(); |
| 24 |
} |
| 25 |
|
| 26 |
public static function getCapabilities() |
| 27 |
{ |
| 28 |
return [ |
| 29 |
'edit_firebox', |
| 30 |
'read_firebox', |
| 31 |
'delete_firebox', |
| 32 |
'edit_fireboxes', |
| 33 |
'edit_others_fireboxes', |
| 34 |
'publish_fireboxes', |
| 35 |
'read_private_fireboxes', |
| 36 |
'read_fireboxes', |
| 37 |
'delete_fireboxes', |
| 38 |
'delete_private_fireboxes', |
| 39 |
'delete_published_fireboxes', |
| 40 |
'delete_others_fireboxes', |
| 41 |
'edit_private_fireboxes', |
| 42 |
'edit_published_fireboxes', |
| 43 |
|
| 44 |
// Standalone permission to run campaign-authored PHP (display condition and |
| 45 |
// PHP Scripts). Deliberately NOT part of getPostTypeCapabilities(), so editing |
| 46 |
// campaigns never grants it implicitly — only administrators get it by default, |
| 47 |
// and a site owner can grant it to another role on purpose. |
| 48 |
'firebox_execute_php', |
| 49 |
|
| 50 |
// Standalone permission to emit campaign-authored JavaScript (the Custom |
| 51 |
// JavaScript setting and the "Run Javascript" action). unfiltered_html also |
| 52 |
// satisfies that gate; this capability exists so administrators keep custom JS |
| 53 |
// where WordPress withholds unfiltered_html (multisite site admins, |
| 54 |
// DISALLOW_UNFILTERED_HTML hosts), and so a site owner can grant it to a |
| 55 |
// trusted role deliberately. Same rules as firebox_execute_php otherwise. |
| 56 |
'firebox_execute_js' |
| 57 |
]; |
| 58 |
} |
| 59 |
|
| 60 |
private function setup() |
| 61 |
{ |
| 62 |
$capabilities = self::getCapabilities(); |
| 63 |
|
| 64 |
$admin = get_role('administrator'); |
| 65 |
|
| 66 |
if ($admin) |
| 67 |
{ |
| 68 |
self::addCapabilities($admin, $capabilities); |
| 69 |
} |
| 70 |
else |
| 71 |
{ |
| 72 |
$roles = get_editable_roles(); |
| 73 |
|
| 74 |
foreach ($roles as $role_name => $data) |
| 75 |
{ |
| 76 |
if (isset($data['capabilities']['manage_options']) && $data['capabilities']['manage_options']) |
| 77 |
{ |
| 78 |
$role = get_role($role_name); |
| 79 |
|
| 80 |
if ($role) |
| 81 |
{ |
| 82 |
self::addCapabilities($role, $capabilities); |
| 83 |
} |
| 84 |
} |
| 85 |
} |
| 86 |
} |
| 87 |
|
| 88 |
wp_get_current_user()->get_role_caps(); |
| 89 |
} |
| 90 |
|
| 91 |
/** |
| 92 |
* Adds the capabilities a role is missing. |
| 93 |
* |
| 94 |
* add_cap() writes the role option on every call, and this now runs on |
| 95 |
* every site of a network, so only the missing ones are added. |
| 96 |
* |
| 97 |
* @param \WP_Role $role |
| 98 |
* @param array $capabilities |
| 99 |
* |
| 100 |
* @return void |
| 101 |
*/ |
| 102 |
private static function addCapabilities($role, $capabilities) |
| 103 |
{ |
| 104 |
foreach ($capabilities as $cap) |
| 105 |
{ |
| 106 |
if ($role->has_cap($cap)) |
| 107 |
{ |
| 108 |
continue; |
| 109 |
} |
| 110 |
|
| 111 |
$role->add_cap($cap); |
| 112 |
} |
| 113 |
} |
| 114 |
} |
