| @@ -1,12 +1,12 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 1.0.7 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | - * @copyright Copyright © 2021 FirePlugins All Rights Reserved | |
| 8 | + * @copyright Copyright © 2026 FirePlugins All Rights Reserved | |
| 9 | 9 | * @license GNU GPLv3 <http://www.gnu.org/licenses/gpl.html> or later |
| 10 | 10 | */ |
| 11 | 11 | |
| 12 | 12 | namespace FireBox\Core\Admin; |
| @@ -22,113 +22,93 @@ | ||
| 22 | 22 | { |
| 23 | 23 | $this->setup(); |
| 24 | 24 | } |
| 25 | 25 | |
| 26 | - private function setup() | |
| 26 | + public static function getCapabilities() | |
| 27 | 27 | { |
| 28 | - global $wp_roles; | |
| 28 | + return [ | |
| 29 | + 'edit_firebox', | |
| 30 | + 'read_firebox', | |
| 31 | + 'delete_firebox', | |
| 32 | + 'edit_fireboxes', | |
| 33 | + 'edit_others_fireboxes', | |
| 34 | + 'publish_fireboxes', | |
| 35 | + 'read_private_fireboxes', | |
| 36 | + 'read_fireboxes', | |
| 37 | + 'delete_fireboxes', | |
| 38 | + 'delete_private_fireboxes', | |
| 39 | + 'delete_published_fireboxes', | |
| 40 | + 'delete_others_fireboxes', | |
| 41 | + 'edit_private_fireboxes', | |
| 42 | + 'edit_published_fireboxes', | |
| 29 | 43 | |
| 30 | - if ( ! class_exists( 'WP_Roles' ) ) { | |
| 31 | - return; | |
| 32 | - } | |
| 44 | + // Standalone permission to run campaign-authored PHP (display condition and | |
| 45 | + // PHP Scripts). Deliberately NOT part of getPostTypeCapabilities(), so editing | |
| 46 | + // campaigns never grants it implicitly — only administrators get it by default, | |
| 47 | + // and a site owner can grant it to another role on purpose. | |
| 48 | + 'firebox_execute_php', | |
| 33 | 49 | |
| 34 | - if ( ! isset( $wp_roles ) ) { | |
| 35 | - $wp_roles = new WP_Roles(); | |
| 36 | - } | |
| 50 | + // Standalone permission to emit campaign-authored JavaScript (the Custom | |
| 51 | + // JavaScript setting and the "Run Javascript" action). unfiltered_html also | |
| 52 | + // satisfies that gate; this capability exists so administrators keep custom JS | |
| 53 | + // where WordPress withholds unfiltered_html (multisite site admins, | |
| 54 | + // DISALLOW_UNFILTERED_HTML hosts), and so a site owner can grant it to a | |
| 55 | + // trusted role deliberately. Same rules as firebox_execute_php otherwise. | |
| 56 | + 'firebox_execute_js' | |
| 57 | + ]; | |
| 58 | + } | |
| 37 | 59 | |
| 38 | - $capabilities = []; | |
| 60 | + private function setup() | |
| 61 | + { | |
| 62 | + $capabilities = self::getCapabilities(); | |
| 39 | 63 | |
| 40 | - // get all CPTs | |
| 41 | - $cpts = [ | |
| 42 | - 'firebox' => [ | |
| 43 | - 'singular' => 'firebox', | |
| 44 | - 'plural' => 'fireboxes' | |
| 45 | - ] | |
| 46 | - ]; | |
| 64 | + $admin = get_role('administrator'); | |
| 47 | 65 | |
| 48 | - foreach ($cpts as $name => $data) | |
| 66 | + if ($admin) | |
| 49 | 67 | { |
| 50 | - $singular = $data['singular']; | |
| 51 | - $plural = $data['plural']; | |
| 68 | + self::addCapabilities($admin, $capabilities); | |
| 69 | + } | |
| 70 | + else | |
| 71 | + { | |
| 72 | + $roles = get_editable_roles(); | |
| 52 | 73 | |
| 53 | - $capabilities[strtolower($name)] = [ | |
| 54 | - 'edit_post' => "edit_$singular", | |
| 55 | - 'read_post' => "read_$singular", | |
| 56 | - 'delete_post' => "delete_$singular", | |
| 57 | - 'edit_posts' => "edit_$plural", | |
| 58 | - 'edit_others_posts' => "edit_others_$plural", | |
| 59 | - 'publish_posts' => "publish_$plural", | |
| 60 | - 'read_private_posts' => "read_private_$plural", | |
| 61 | - 'read' => "read_$singular", | |
| 62 | - 'delete_posts' => "delete_$plural", | |
| 63 | - 'delete_private_posts' => "delete_private_$plural", | |
| 64 | - 'delete_published_posts' => "delete_published_$plural", | |
| 65 | - 'delete_others_posts' => "delete_others_$plural", | |
| 66 | - 'edit_private_posts' => "edit_private_$plural", | |
| 67 | - 'edit_published_posts' => "edit_published_$plural", | |
| 68 | - 'create_posts' => "edit_$plural", | |
| 69 | - ]; | |
| 70 | - | |
| 71 | - // also add taxonomies | |
| 72 | - if (isset($data['taxonomies']) && is_array($data['taxonomies']) && count($data['taxonomies'])) | |
| 74 | + foreach ($roles as $role_name => $data) | |
| 73 | 75 | { |
| 74 | - foreach ($data['taxonomies'] as $tax) | |
| 76 | + if (isset($data['capabilities']['manage_options']) && $data['capabilities']['manage_options']) | |
| 75 | 77 | { |
| 76 | - $tmp_tax = $name . '_' . $tax; | |
| 77 | - | |
| 78 | - $capabilities[strtolower($name)]["manage_{$name}_{$tmp_tax}_terms"] = "manage_{$name}_{$tmp_tax}_terms"; | |
| 79 | - $capabilities[strtolower($name)]["edit_{$name}_{$tmp_tax}_terms"] = "edit_{$name}_{$tmp_tax}_terms"; | |
| 80 | - $capabilities[strtolower($name)]["assign_{$name}_{$tmp_tax}_terms"] = "assign_{$name}_{$tmp_tax}_terms"; | |
| 81 | - $capabilities[strtolower($name)]["delete_{$name}_{$tmp_tax}_terms"] = "delete_{$name}_{$tmp_tax}_terms"; | |
| 82 | - } | |
| 83 | - } | |
| 84 | - } | |
| 78 | + $role = get_role($role_name); | |
| 85 | 79 | |
| 86 | - //Set capabilities to all roles with cap:"". | |
| 87 | - $roles = $wp_roles->get_names(); | |
| 88 | - | |
| 89 | - // add capabilities to all roles | |
| 90 | - foreach ( $capabilities as $name => $capabilities) { | |
| 91 | - $capabilities_data = array_values($capabilities); | |
| 92 | - | |
| 93 | - // all roles | |
| 94 | - foreach ( $roles as $current_role => $role_name ) { | |
| 95 | - if ( isset( $wp_roles->roles[ $current_role ][ 'capabilities' ][ 'manage_options' ] ) ) { | |
| 96 | - $role = get_role( $current_role ); | |
| 97 | - if ( isset( $role ) && is_object( $role ) ) { | |
| 98 | - for ( $i = 0, $caps_limit = count( $capabilities_data ); $i < $caps_limit; $i ++ ) { | |
| 99 | - if ( ! isset( $wp_roles->roles[ $current_role ][ 'capabilities' ][ $capabilities_data[ $i ] ] ) ) { | |
| 100 | - $role->add_cap( $capabilities_data[ $i ] ); | |
| 101 | - } | |
| 102 | - } | |
| 80 | + if ($role) | |
| 81 | + { | |
| 82 | + self::addCapabilities($role, $capabilities); | |
| 103 | 83 | } |
| 104 | - | |
| 105 | 84 | } |
| 106 | 85 | } |
| 86 | + } | |
| 107 | 87 | |
| 108 | - // all admins | |
| 109 | - $user_admins = get_users( array( | |
| 110 | - 'role' => 'administrator' | |
| 111 | - ) ); | |
| 88 | + wp_get_current_user()->get_role_caps(); | |
| 89 | + } | |
| 112 | 90 | |
| 113 | - if ( is_multisite() ) { | |
| 114 | - $super_admins = get_super_admins(); | |
| 115 | - | |
| 116 | - foreach( $super_admins as $admin ) { | |
| 117 | - $super_admin = new \WP_User( $admin ); | |
| 118 | - | |
| 119 | - if ( ! in_array( $super_admin, $user_admins, true ) ) { | |
| 120 | - $user_admins[] = $super_admin; | |
| 121 | - } | |
| 122 | - } | |
| 91 | + /** | |
| 92 | + * Adds the capabilities a role is missing. | |
| 93 | + * | |
| 94 | + * add_cap() writes the role option on every call, and this now runs on | |
| 95 | + * every site of a network, so only the missing ones are added. | |
| 96 | + * | |
| 97 | + * @param \WP_Role $role | |
| 98 | + * @param array $capabilities | |
| 99 | + * | |
| 100 | + * @return void | |
| 101 | + */ | |
| 102 | + private static function addCapabilities($role, $capabilities) | |
| 103 | + { | |
| 104 | + foreach ($capabilities as $cap) | |
| 105 | + { | |
| 106 | + if ($role->has_cap($cap)) | |
| 107 | + { | |
| 108 | + continue; | |
| 123 | 109 | } |
| 124 | 110 | |
| 125 | - foreach ( $user_admins as $user ) { | |
| 126 | - if ( $user->exists() ) { | |
| 127 | - for ( $i = 0, $caps_limit = count( $capabilities_data ); $i < $caps_limit; $i ++ ) { | |
| 128 | - $user->add_cap( $capabilities_data[ $i ] ); | |
| 129 | - } | |
| 130 | - } | |
| 131 | - } | |
| 111 | + $role->add_cap($cap); | |
| 132 | 112 | } |
| 133 | 113 | } |
| 134 | 114 | } |
