← All changes | lib/admin/groups-admin-capabilities-remove.php +57 -62 1.11.3 → 4.7.0 View file →

		@@ -24,71 +24,69 @@
24	24	}
25	25
26	26	/**
27	27	* Shows form to confirm capability deletion.
	28	+ *
28	29	* @param int $capability_id capability id
29	30	*/
30	31	function groups_admin_capabilities_remove( $capability_id ) {
31	32
32		- global $wpdb;
33		-
34		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
35		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	33	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	34	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
36	35	}
37	36
38		- $capability = Groups_Capability::read( intval( $capability_id ) );
	37	+ $capability = new Groups_Capability( $capability_id );
39	38
40		- if ( empty( $capability ) ) {
41		- wp_die( __( 'No such capability.', GROUPS_PLUGIN_DOMAIN ) );
	39	+ if ( empty( $capability ) ) { // @phpstan-ignore empty.variable
	40	+ wp_die( esc_html__( 'No such capability.', 'groups' ) );
42	41	}
43	42
44		- $capability_table = _groups_get_tablename( 'capability' );
45		-
46		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	43	+ $current_url = groups_get_current_url();
47	44	$current_url = remove_query_arg( 'action', $current_url );
48	45	$current_url = remove_query_arg( 'capability_id', $current_url );
49	46
50		- $output =
51		- '<div class="manage-capabilities wrap">' .
52		- '<h1>' .
53		- __( 'Remove a capability', GROUPS_PLUGIN_DOMAIN ) .
54		- '</h1>' .
55		- '<form id="remove-capability" action="' . esc_url( $current_url ) . '" method="post">' .
56		- '<div class="capability remove">' .
57		- '<input id="capability-id-field" name="capability-id-field" type="hidden" value="' . esc_attr( intval( $capability->capability_id ) ) . '"/>' .
58		- '<ul>' .
59		- '<li>' . sprintf( __( 'Capability : %s', GROUPS_PLUGIN_DOMAIN ), stripslashes( wp_filter_nohtml_kses( $capability->capability ) ) ) . '</li>' .
60		- '</ul> ' .
61		- wp_nonce_field( 'capabilities-remove', GROUPS_ADMIN_GROUPS_NONCE, true, false ) .
62		- '<input class="button button-primary" type="submit" value="' . __( 'Remove', GROUPS_PLUGIN_DOMAIN ) . '"/>' .
63		- '<input type="hidden" value="remove" name="action"/>' .
64		- '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>' .
65		- '</div>' .
66		- '</div>' . // .capability.remove
67		- '</form>' .
68		- '</div>'; // .manage-capabilities
	47	+ $output = '<div class="manage-capabilities wrap">';
	48	+ $output .= '<h1>';
	49	+ $output .= esc_html__( 'Remove a capability', 'groups' );
	50	+ $output .= '</h1>';
	51	+ $output .= sprintf( '<form id="remove-capability" action="%s" method="post">', esc_url( $current_url ) );
	52	+ $output .= '<div class="capability remove">';
	53	+ $output .= sprintf( '<input id="capability-id-field" name="capability-id-field" type="hidden" value="%s"/>', esc_attr( intval( $capability->get_capability_id() ) ) );
	54	+ $output .= '<ul>';
	55	+ $output .= '<li>';
	56	+ $output .= sprintf( '%s : %s', esc_html__( 'Capability', 'groups' ), stripslashes( wp_filter_nohtml_kses( $capability->get_capability() ) ) );
	57	+ $output .= '</li>';
	58	+ $output .= '</ul> ';
	59	+ $output .= wp_nonce_field( 'capabilities-remove', GROUPS_ADMIN_GROUPS_NONCE, true, false );
	60	+ $output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Remove', 'groups' ) );
	61	+ $output .= '<input type="hidden" value="remove" name="action"/>';
	62	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
	63	+ $output .= '</div>';
	64	+ $output .= '</div>'; // .capability.remove
	65	+ $output .= '</form>';
	66	+ $output .= '</div>'; // .manage-capabilities
69	67
70		- echo $output;
	68	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
71	69	} // function groups_admin_capabilities_remove
72	70
73	71	/**
74	72	* Handle remove form submission.
	73	+ *
	74	+ * @return int|boolean ID of the deleted capability or false on failure
75	75	*/
76	76	function groups_admin_capabilities_remove_submit() {
77	77
78		- global $wpdb;
79		-
80	78	$result = false;
81	79
82		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
83		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	80	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	81	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
84	82	}
85	83
86		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'capabilities-remove' ) ) {
87		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	84	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'capabilities-remove' ) ) {
	85	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
88	86	}
89	87
90		- $capability_id = isset( $_POST['capability-id-field'] ) ? $_POST['capability-id-field'] : null;
	88	+ $capability_id = groups_sanitize_post( 'capability-id-field' );
91	89	$capability = Groups_Capability::read( $capability_id );
92	90	if ( $capability ) {
93	91	if ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) {
94	92	$result = Groups_Capability::delete( $capability_id );
		@@ -101,20 +99,18 @@
101	99	* Shows form to confirm removal bulk capabilities
102	100	*/
103	101	function groups_admin_capabilities_bulk_remove() {
104	102
105		- global $wpdb;
106		-
107	103	$output = '';
108	104
109		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
110		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	105	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	106	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
111	107	}
112	108
113		- $capability_ids = isset( $_POST['capability_ids'] ) ? $_POST['capability_ids'] : null;
	109	+ $capability_ids = groups_sanitize_post( 'capability_ids' );
114	110
115		- if ( ! $capability_ids ) {
116		- wp_die( __( 'No such capabilities.', GROUPS_PLUGIN_DOMAIN ) );
	111	+ if ( $capability_ids === null || !is_array( $capability_ids ) ) {
	112	+ wp_die( esc_html__( 'No such capabilities.', 'groups' ) );
117	113	}
118	114
119	115	$capabilities = array();
120	116	foreach ( $capability_ids as $capability_id ) {
		@@ -123,32 +119,32 @@
123	119	$capabilities[] = $capability;
124	120	}
125	121	}
126	122
127		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	123	+ $current_url = groups_get_current_url();
128	124	$current_url = remove_query_arg( 'action', $current_url );
129	125	$current_url = remove_query_arg( 'capability_id', $current_url );
130	126
131	127	$output .= '<div class="manage-capabilities wrap">';
132	128	$output .= '<h1>';
133		- $output .= __( 'Remove capabilities', GROUPS_PLUGIN_DOMAIN );
	129	+ $output .= esc_html__( 'Remove capabilities', 'groups' );
134	130	$output .= '</h1>';
135	131
136	132	$output .= '<form id="capabilities-action" method="post" action="">';
137	133	$output .= '<div class="capability remove">';
138	134	$output .= '<p>';
139		- $output .= __( 'Please confirm to remove the following capabilities. This action cannot be undone.', GROUPS_PLUGIN_DOMAIN );
	135	+ $output .= esc_html__( 'Please confirm to remove the following capabilities. This action cannot be undone.', 'groups' );
140	136	$output .= '</p>';
	137	+ $output .= '<ul class="groups-capability-bulk-remove">';
141	138	foreach ( $capabilities as $capability ) {
142		- $output .= '<input id="capability_ids" name="capability_ids[]" type="hidden" value="' . esc_attr( intval( $capability->capability_id ) ) . '"/>';
143		- $output .= '<ul>';
	139	+ $output .= sprintf( '<input id="capability_ids" name="capability_ids[]" type="hidden" value="%s"/>', esc_attr( intval( $capability->capability_id ) ) );
144	140	$output .= '<li>';
145		- $output .= sprintf( __( '<strong>%s</strong>', GROUPS_PLUGIN_DOMAIN ), wp_filter_nohtml_kses( $capability->capability ) );
	141	+ $output .= sprintf( '<strong>%s</strong>', stripslashes( wp_filter_nohtml_kses( $capability->capability ) ) );
146	142	$output .= '</li>';
147		- $output .= '</ul>';
148	143	}
149		- $output .= '<input class="button button-primary" type="submit" name="bulk" value="' . __( "Remove", GROUPS_PLUGIN_DOMAIN ) . '"/>';
150		- $output .= '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>';
	144	+ $output .= '</ul>';
	145	+ $output .= sprintf( '<input class="button button-primary" type="submit" name="bulk" value="%s"/>', esc_attr__( 'Remove', 'groups' ) );
	146	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
151	147
152	148	$output .= '<input type="hidden" name="action" value="groups-action"/>';
153	149	$output .= '<input type="hidden" name="bulk-action" value="remove"/>';
154	150	$output .= '<input type="hidden" name="confirm" value="1"/>';
		@@ -157,32 +153,31 @@
157	153	$output .= '</div>';
158	154	$output .= '</form>';
159	155	$output .= '</div>';
160	156
161		- echo $output;
	157	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
162	158	} // function groups_admin_capabilities_bulk_remove
163	159
164	160	/**
165	161	* Handle remove form submission.
	162	+ *
166	163	* @return array of deleted capabilities' ids
167	164	*/
168	165	function groups_admin_capabilities_bulk_remove_submit() {
169	166
170		- global $wpdb;
171		-
172	167	$result = array();
173	168
174		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
175		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	169	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	170	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
176	171	}
177	172
178		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_ACTION_NONCE], 'admin' ) ) {
179		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	173	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_ACTION_NONCE, 'admin' ) ) {
	174	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
180	175	}
181	176
182		- $capability_ids = isset( $_POST['capability_ids'] ) ? $_POST['capability_ids'] : null;
	177	+ $capability_ids = groups_sanitize_post( 'capability_ids' );
183	178
184		- if ( $capability_ids ) {
	179	+ if ( $capability_ids !== null && is_array( $capability_ids ) ) {
185	180	foreach ( $capability_ids as $capability_id ) {
186	181	$capability = Groups_Capability::read( $capability_id );
187	182	if ( $capability ) {
188	183	if ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) {