groups / lib / admin / groups-admin-capabilities-edit.php

groups-admin-capabilities-edit.php in Groups – Memberships and Access Control 3.9.0, at lib/admin/groups-admin-capabilities-edit.php

144 lines 6.3 KB

Raw Download Zip

1	<?php
2	/**
3	* groups-admin-capability-edit.php
4	*
5	* Copyright (c) "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.0.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	/**
27	* Show edit capability form.
28	*
29	* @param int $capability_id capability id
30	*/
31	function groups_admin_capabilities_edit( $capability_id ) {
32
33	global $wpdb;
34
35	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
36	wp_die( esc_html__( 'Access denied.', 'groups' ) );
37	}
38
39	$capability = Groups_Capability::read( intval( $capability_id ) );
40
41	if ( empty( $capability ) ) { // @phpstan-ignore empty.variable
42	wp_die( esc_html__( 'No such capability.', 'groups' ) );
43	}
44
45	$current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
46	$current_url = remove_query_arg( 'action', $current_url );
47	$current_url = remove_query_arg( 'capability_id', $current_url );
48
49	$capability_capability = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : ( $capability->capability !== null ? $capability->capability : '' );
50	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ( $capability->description !==null ? $capability->description : '' );
51
52	$capability_readonly = ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) ? "" : ' readonly="readonly" ';
53
54	$output = '<div class="manage-capabilities wrap">';
55	$output .= '<h1>';
56	$output .= esc_html__( 'Edit a capability', 'groups' );
57	$output .= '</h1>';
58
59	$output .= Groups_Admin::render_messages();
60
61	$output .= sprintf( '<form id="edit-capability" action="%s" method="post">', esc_url( $current_url ) );
62	$output .= '<div class="capability edit">';
63	$output .= sprintf( '<input id="capability-id-field" name="capability-id-field" type="hidden" value="%s"/>', esc_attr( intval( $capability_id ) ) );
64
65	$output .= '<div class="field">';
66	$output .= sprintf( '<label for="capability-field" class="field-label first required">%s</label>', esc_html__( 'Capability', 'groups' ) );
67	$output .= sprintf(
68	'<input %s id="capability-field" name="capability-field" class="capability-field" type="text" value="%s"/>',
69	$capability_readonly,
70	esc_attr( stripslashes( $capability_capability ) )
71	);
72	$output .= '</div>';
73
74	$output .= '<div class="field">';
75	$output .= sprintf( '<label for="description-field" class="field-label description-field">%s</label>', esc_html__( 'Description', 'groups' ) );
76	$output .= sprintf( '<textarea id="description-field" name="description-field" rows="5" cols="45">%s</textarea>', stripslashes( wp_filter_nohtml_kses( $description ) ) );
77	$output .= '</div>';
78
79	$output .= '<div class="field">';
80	$output .= wp_nonce_field( 'capabilities-edit', GROUPS_ADMIN_GROUPS_NONCE, true, false );
81	$output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Save', 'groups' ) );
82	$output .= '<input type="hidden" value="edit" name="action"/>';
83	$output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
84	$output .= '</div>';
85	$output .= '</div>'; // .capability.edit
86	$output .= '</form>';
87	$output .= '</div>'; // .manage-capabilities
88
89	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
90	} // function groups_admin_capabilities_edit
91
92	/**
93	* Handle edit form submission.
94	*
95	* @return int\|boolean the capability ID if it was updated, otherwise false
96	*/
97	function groups_admin_capabilities_edit_submit() {
98
99	$result = false;
100
101	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
102	wp_die( esc_html__( 'Access denied.', 'groups' ) );
103	}
104
105	if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'capabilities-edit' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
106	wp_die( esc_html__( 'Access denied.', 'groups' ) );
107	}
108
109	$capability_id = isset( $_POST['capability-id-field'] ) ? $_POST['capability-id-field'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
110	$capability = Groups_Capability::read( $capability_id );
111	if ( $capability ) {
112	$capability = new Groups_Capability( $capability_id );
113	$capability_id = $capability->get_capability_id();
114	if ( $capability->get_capability() !== Groups_Post_Access::READ_POST_CAPABILITY ) {
115	$capability_field = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : null;
116	} else {
117	$capability_field = Groups_Post_Access::READ_POST_CAPABILITY;
118	}
119	if ( !empty( $capability_field ) ) {
120	$update = true;
121	if ( $other_capability = Groups_Capability::read_by_capability( $capability_field ) ) {
122	if ( $other_capability->capability_id != $capability_id ) {
123	/* translators: capability name */
124	Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability already exists and cannot be assigned to this one.', 'groups' ), stripslashes( wp_filter_nohtml_kses( $other_capability->capability ) ) ), 'error' );
125	$update = false;
126	}
127	}
128	if ( $update ) {
129	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : '';
130	$capability_id = Groups_Capability::update( array( 'capability_id' => $capability_id, 'capability' => $capability_field, 'description' => $description ) );
131	if ( $capability_id ) {
132	$result = $capability_id;
133	} else {
134	/* translators: capability name */
135	Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability could not be updated.', 'groups' ), stripslashes( wp_filter_nohtml_kses( $capability->get_capability() ) ) ), 'error' );
136	}
137	}
138	} else {
139	Groups_Admin::add_message( __( 'The <em>Capability</em> must not be empty.', 'groups' ), 'error' );
140	}
141	}
142	return $result;
143	} // function groups_admin_capabilities_edit_submit
144