groups / lib / admin / groups-admin-groups-add.php

groups-admin-groups-add.php in Groups – Memberships and Access Control 3.9.0, at lib/admin/groups-admin-groups-add.php

182 lines 7.3 KB

Raw Download Zip

1	<?php
2	/**
3	* groups-admin-groups-add.php
4	*
5	* Copyright (c) "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.1.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	// phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
27
28	/**
29	* Show add group form.
30	*/
31	function groups_admin_groups_add() {
32
33	global $wpdb;
34
35	$output = '';
36
37	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
38	wp_die( esc_html__( 'Access denied.', 'groups' ) );
39	}
40
41	$current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
42	$current_url = remove_query_arg( 'paged', $current_url );
43	$current_url = remove_query_arg( 'action', $current_url );
44	$current_url = remove_query_arg( 'group_id', $current_url );
45
46	$parent_id = isset( $_POST['parent-id-field'] ) ? sanitize_text_field( $_POST['parent-id-field'] ) : '';
47	$name = isset( $_POST['name-field'] ) ? sanitize_text_field( $_POST['name-field'] ) : '';
48	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : '';
49
50	$parent_select = '<select name="parent-id-field">';
51	$parent_select .= sprintf(
52	'<option value="" %s>--</option>',
53	empty( $parent_id ) ? 'selected="selected"' : ''
54	);
55	$tree = Groups_Utility::get_tree();
56	Groups_Utility::render_tree_options( $tree, $parent_select, 0, array( $parent_id ) );
57	$parent_select .= '</select>';
58
59	$output .= '<div class="manage-groups wrap">';
60	$output .= '<h1>';
61	$output .= esc_html__( 'Add a new group', 'groups' );
62	$output .= '</h1>';
63
64	$output .= Groups_Admin::render_messages();
65
66	$output .= '<form id="add-group" action="' . esc_url( $current_url ) . '" method="post">';
67	$output .= '<div class="group new">';
68
69	$output .= '<div class="field">';
70	$output .= '<label for="name-field" class="field-label first required">';
71	$output .= esc_html__( 'Name', 'groups' );
72	$output .= '</label>';
73	$output .= sprintf( '<input id="name-field" name="name-field" class="namefield" type="text" value="%s"/>', esc_attr( stripslashes( $name ) ) );
74	$output .= '</div>';
75
76	$output .= '<div class="field">';
77	$output .= '<label for="parent-id-field" class="field-label">';
78	$output .= esc_html__( 'Parent', 'groups' );
79	$output .= '</label>';
80	$output .= $parent_select;
81	$output .= '</div>';
82
83	$output .= '<div class="field">';
84	$output .= '<label for="description-field" class="field-label description-field">';
85	$output .= esc_html__( 'Description', 'groups' );
86	$output .= '</label>';
87	$output .= '<textarea id="description-field" name="description-field" rows="5" cols="45">';
88	$output .= stripslashes( wp_filter_nohtml_kses( $description ) );
89	$output .= '</textarea>';
90	$output .= '</div>';
91
92	$output .= '<div class="field">';
93
94	$capability_table = _groups_get_tablename( "capability" );
95	$capabilities = $wpdb->get_results( "SELECT * FROM $capability_table ORDER BY capability" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
96	$selected_capabilities = isset( $_POST['capability_ids'] ) && is_array( $_POST['capability_ids'] ) ? $_POST['capability_ids'] : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
97
98	$output .= '<div class="select-capability-container" style="width:62%;">';
99	$output .= '<label>';
100	$output .= esc_html__( 'Capabilities', 'groups' );
101	$output .= sprintf(
102	'<select class="select capability" name="capability_ids[]" multiple="multiple" placeholder="%s">',
103	esc_attr__( 'Choose capabilities …', 'groups' )
104	);
105	foreach( $capabilities as $capability ) {
106	$output .= sprintf(
107	'<option value="%s" %s>%s</option>',
108	esc_attr( $capability->capability_id ),
109	in_array( $capability->capability_id, $selected_capabilities ) ? 'selected="selected"' : '',
110	stripslashes( wp_filter_nohtml_kses( $capability->capability ) )
111	);
112	}
113	$output .= '</select>';
114	$output .= '</label>';
115	$output .= '</div>';
116	$output .= '<p class="description">';
117	$output .= esc_html__( 'These capabilities will be assigned to the group.', 'groups' );
118	$output .= '</p>';
119
120	$output .= Groups_UIE::render_select( '.select.capability' );
121	$output .= '</div>';
122
123	$output .= apply_filters( 'groups_admin_groups_add_form_after_fields', '' );
124
125	$output .= '<div class="field">';
126	$output .= wp_nonce_field( 'groups-add', GROUPS_ADMIN_GROUPS_NONCE, true, false );
127	$output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Add', 'groups' ) );
128	$output .= '<input type="hidden" value="add" name="action"/>';
129	$output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
130	$output .= '</div>';
131	$output .= '</div>'; // .group.new
132	$output .= '</form>';
133	$output .= '</div>'; // .manage-groups
134
135	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
136	} // function groups_admin_groups_add
137
138	/**
139	* Handle add group form submission.
140	*
141	* @return int new group's id or false if unsuccessful
142	*/
143	function groups_admin_groups_add_submit() {
144
145	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
146	wp_die( esc_html__( 'Access denied.', 'groups' ) );
147	}
148
149	if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'groups-add' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
150	wp_die( esc_html__( 'Access denied.', 'groups' ) );
151	}
152
153	$creator_id = get_current_user_id();
154	$datetime = date( 'Y-m-d H:i:s', time() ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
155	$parent_id = isset( $_POST['parent-id-field'] ) ? sanitize_text_field( $_POST['parent-id-field'] ) : null;
156	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : '';
157	$name = isset( $_POST['name-field'] ) ? sanitize_text_field( $_POST['name-field'] ) : null;
158
159	$group_id = Groups_Group::create( compact( "creator_id", "datetime", "parent_id", "description", "name" ) );
160	if ( $group_id ) {
161	if ( !empty( $_POST['capability_ids'] ) ) {
162	$caps = $_POST['capability_ids']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
163	if ( is_array( $caps ) ) {
164	$caps = array_map( 'sanitize_text_field', $caps );
165	foreach( $caps as $cap ) {
166	Groups_Group_Capability::create( array( 'group_id' => $group_id, 'capability_id' => $cap ) );
167	}
168	}
169	}
170	do_action( 'groups_admin_groups_add_submit_success', $group_id );
171	} else {
172	if ( !$name ) {
173	Groups_Admin::add_message( __( 'The name must not be empty.', 'groups' ), 'error' );
174	} else if ( Groups_Group::read_by_name( $name ) ) {
175	/* translators: group name */
176	Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> group already exists.', 'groups' ), stripslashes( wp_filter_nohtml_kses( ( $name ) ) ) ), 'error' );
177	}
178	}
179
180	return $group_id;
181	} // function groups_admin_groups_add_submit
182