groups / lib / admin / groups-admin-capabilities-remove.php

groups-admin-capabilities-remove.php in Groups – Memberships and Access Control 3.9.0, at lib/admin/groups-admin-capabilities-remove.php

194 lines 7.5 KB

Raw Download Zip

1	<?php
2	/**
3	* groups-admin-capabilities-remove.php
4	*
5	* Copyright (c) "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.0.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	/**
27	* Shows form to confirm capability deletion.
28	*
29	* @param int $capability_id capability id
30	*/
31	function groups_admin_capabilities_remove( $capability_id ) {
32
33	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
34	wp_die( esc_html__( 'Access denied.', 'groups' ) );
35	}
36
37	$capability = new Groups_Capability( $capability_id );
38
39	if ( empty( $capability ) ) { // @phpstan-ignore empty.variable
40	wp_die( esc_html__( 'No such capability.', 'groups' ) );
41	}
42
43	$current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
44	$current_url = remove_query_arg( 'action', $current_url );
45	$current_url = remove_query_arg( 'capability_id', $current_url );
46
47	$output = '<div class="manage-capabilities wrap">';
48	$output .= '<h1>';
49	$output .= esc_html__( 'Remove a capability', 'groups' );
50	$output .= '</h1>';
51	$output .= sprintf( '<form id="remove-capability" action="%s" method="post">', esc_url( $current_url ) );
52	$output .= '<div class="capability remove">';
53	$output .= sprintf( '<input id="capability-id-field" name="capability-id-field" type="hidden" value="%s"/>', esc_attr( intval( $capability->get_capability_id() ) ) );
54	$output .= '<ul>';
55	$output .= '<li>';
56	$output .= sprintf( '%s : %s', esc_html__( 'Capability', 'groups' ), stripslashes( wp_filter_nohtml_kses( $capability->get_capability() ) ) );
57	$output .= '</li>';
58	$output .= '</ul> ';
59	$output .= wp_nonce_field( 'capabilities-remove', GROUPS_ADMIN_GROUPS_NONCE, true, false );
60	$output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Remove', 'groups' ) );
61	$output .= '<input type="hidden" value="remove" name="action"/>';
62	$output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
63	$output .= '</div>';
64	$output .= '</div>'; // .capability.remove
65	$output .= '</form>';
66	$output .= '</div>'; // .manage-capabilities
67
68	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
69	} // function groups_admin_capabilities_remove
70
71	/**
72	* Handle remove form submission.
73	*
74	* @return int\|boolean ID of the deleted capability or false on failure
75	*/
76	function groups_admin_capabilities_remove_submit() {
77
78	$result = false;
79
80	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
81	wp_die( esc_html__( 'Access denied.', 'groups' ) );
82	}
83
84	if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'capabilities-remove' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
85	wp_die( esc_html__( 'Access denied.', 'groups' ) );
86	}
87
88	$capability_id = isset( $_POST['capability-id-field'] ) ? $_POST['capability-id-field'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
89	$capability = Groups_Capability::read( $capability_id );
90	if ( $capability ) {
91	if ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) {
92	$result = Groups_Capability::delete( $capability_id );
93	}
94	}
95	return $result;
96	} // function groups_admin_capabilities_remove_submit
97
98	/**
99	* Shows form to confirm removal bulk capabilities
100	*/
101	function groups_admin_capabilities_bulk_remove() {
102
103	$output = '';
104
105	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
106	wp_die( esc_html__( 'Access denied.', 'groups' ) );
107	}
108
109	$capability_ids = isset( $_POST['capability_ids'] ) ? $_POST['capability_ids'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
110
111	if ( $capability_ids === null \|\| !is_array( $capability_ids ) ) {
112	wp_die( esc_html__( 'No such capabilities.', 'groups' ) );
113	}
114
115	$capabilities = array();
116	foreach ( $capability_ids as $capability_id ) {
117	$capability = Groups_Capability::read( intval( $capability_id ) );
118	if ( $capability ) {
119	$capabilities[] = $capability;
120	}
121	}
122
123	$current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
124	$current_url = remove_query_arg( 'action', $current_url );
125	$current_url = remove_query_arg( 'capability_id', $current_url );
126
127	$output .= '<div class="manage-capabilities wrap">';
128	$output .= '<h1>';
129	$output .= esc_html__( 'Remove capabilities', 'groups' );
130	$output .= '</h1>';
131
132	$output .= '<form id="capabilities-action" method="post" action="">';
133	$output .= '<div class="capability remove">';
134	$output .= '<p>';
135	$output .= esc_html__( 'Please confirm to remove the following capabilities. This action cannot be undone.', 'groups' );
136	$output .= '</p>';
137	$output .= '<ul class="groups-capability-bulk-remove">';
138	foreach ( $capabilities as $capability ) {
139	$output .= sprintf( '<input id="capability_ids" name="capability_ids[]" type="hidden" value="%s"/>', esc_attr( intval( $capability->capability_id ) ) );
140	$output .= '<li>';
141	$output .= sprintf( '<strong>%s</strong>', stripslashes( wp_filter_nohtml_kses( $capability->capability ) ) );
142	$output .= '</li>';
143	}
144	$output .= '</ul>';
145	$output .= sprintf( '<input class="button button-primary" type="submit" name="bulk" value="%s"/>', esc_attr__( 'Remove', 'groups' ) );
146	$output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
147
148	$output .= '<input type="hidden" name="action" value="groups-action"/>';
149	$output .= '<input type="hidden" name="bulk-action" value="remove"/>';
150	$output .= '<input type="hidden" name="confirm" value="1"/>';
151	$output .= wp_nonce_field( 'admin', GROUPS_ADMIN_GROUPS_ACTION_NONCE, true, false );
152
153	$output .= '</div>';
154	$output .= '</form>';
155	$output .= '</div>';
156
157	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
158	} // function groups_admin_capabilities_bulk_remove
159
160	/**
161	* Handle remove form submission.
162	*
163	* @return array of deleted capabilities' ids
164	*/
165	function groups_admin_capabilities_bulk_remove_submit() {
166
167	$result = array();
168
169	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
170	wp_die( esc_html__( 'Access denied.', 'groups' ) );
171	}
172
173	if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_ACTION_NONCE], 'admin' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
174	wp_die( esc_html__( 'Access denied.', 'groups' ) );
175	}
176
177	$capability_ids = isset( $_POST['capability_ids'] ) ? $_POST['capability_ids'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
178
179	if ( $capability_ids !== null && is_array( $capability_ids ) ) {
180	foreach ( $capability_ids as $capability_id ) {
181	$capability = Groups_Capability::read( $capability_id );
182	if ( $capability ) {
183	if ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) {
184	if ( Groups_Capability::delete( $capability_id ) ) {
185	$result[] = $capability->capability_id;
186	}
187	}
188	}
189	}
190	}
191
192	return $result;
193	} // function groups_admin_capabilities_bulk_remove_submit
194