| @@ -22,13 +22,20 @@ | ||
| 22 | 22 | if ( !defined( 'ABSPATH' ) ) { |
| 23 | 23 | exit; |
| 24 | 24 | } |
| 25 | 25 | |
| 26 | +// phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching | |
| 27 | + | |
| 26 | 28 | /** |
| 27 | 29 | * Users admin integration with Groups. |
| 28 | 30 | */ |
| 29 | 31 | class Groups_Admin_Users { |
| 30 | 32 | |
| 33 | + /** | |
| 34 | + * Column key. | |
| 35 | + * | |
| 36 | + * @var string | |
| 37 | + */ | |
| 31 | 38 | const GROUPS = 'groups_user_groups'; |
| 32 | 39 | |
| 33 | 40 | /** |
| 34 | 41 | * Hooks into filters to add the Groups column to the users table. |
| @@ -38,24 +45,23 @@ | ||
| 38 | 45 | add_action( 'admin_init', array( __CLASS__, 'setup' ) ); |
| 39 | 46 | } |
| 40 | 47 | |
| 41 | 48 | /** |
| 42 | - * Adds the filters and actions only for users who have the right | |
| 43 | - * Groups permissions. | |
| 49 | + * Adds the filters and actions only for users who have the right Groups permissions. | |
| 44 | 50 | */ |
| 45 | 51 | public static function setup() { |
| 46 | - if ( current_user_can( GROUPS_ACCESS_GROUPS ) ) { | |
| 52 | + if ( Groups_User::current_user_can( GROUPS_ACCESS_GROUPS ) ) { | |
| 47 | 53 | // filters to display the user's groups |
| 48 | 54 | add_filter( 'manage_users_columns', array( __CLASS__, 'manage_users_columns' ) ); |
| 49 | 55 | // args: unknown, string $column_name, int $user_id |
| 50 | 56 | add_filter( 'manage_users_custom_column', array( __CLASS__, 'manage_users_custom_column' ), 10, 3 ); |
| 51 | 57 | } |
| 52 | - if ( current_user_can( GROUPS_ADMINISTER_GROUPS ) ) { | |
| 58 | + if ( Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) { | |
| 53 | 59 | if ( !is_network_admin() ) { |
| 54 | 60 | // scripts |
| 55 | 61 | add_action( 'admin_enqueue_scripts', array( __CLASS__, 'admin_enqueue_scripts' ) ); |
| 56 | 62 | // styles |
| 57 | - add_action( 'admin_head', array( __CLASS__, 'admin_head' ) ); | |
| 63 | + // add_action( 'admin_head', array( __CLASS__, 'admin_head' ) ); | |
| 58 | 64 | // allow to add or remove selected users to groups |
| 59 | 65 | add_action( 'load-users.php', array( __CLASS__, 'load_users' ) ); |
| 60 | 66 | // add links to filter users by group |
| 61 | 67 | add_filter( 'views_users', array( __CLASS__, 'views_users' ) ); |
| @@ -62,9 +68,9 @@ | ||
| 62 | 68 | // modify query to filter users by group |
| 63 | 69 | add_filter( 'pre_user_query', array( __CLASS__, 'pre_user_query' ) ); |
| 64 | 70 | // WP_Users_List_Table implements extra_tablenav() where the restrict_manage_users action is invoked. |
| 65 | 71 | // As the extra_tablenav() method does not define a generic extension point, this is |
| 66 | - // the best shot we get at inserting our group actions block (currently we're at WordPress 3.6.1). | |
| 72 | + // the best shot we get at inserting our group actions block (currently we're at WordPress 3.6.1). | |
| 67 | 73 | // We choose to use our own group-actions block instead of re-using the existing bulk-actions, |
| 68 | 74 | // to have a more explicit user interface which makes it clear that these actions |
| 69 | 75 | // are directed at relating users and groups. |
| 70 | 76 | add_action( 'restrict_manage_users', array( __CLASS__, 'restrict_manage_users' ), 0 ); |
| @@ -73,31 +79,41 @@ | ||
| 73 | 79 | } |
| 74 | 80 | |
| 75 | 81 | /** |
| 76 | 82 | * Modify query to filter users by group. |
| 77 | - * | |
| 83 | + * | |
| 78 | 84 | * @param WP_User_Query $user_query |
| 85 | + * | |
| 79 | 86 | * @return WP_User_Query |
| 80 | 87 | */ |
| 81 | 88 | public static function pre_user_query( $user_query ) { |
| 82 | 89 | global $pagenow, $wpdb; |
| 83 | - if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) { | |
| 84 | - if ( isset( $_REQUEST['group'] ) ) { | |
| 85 | - $group_id = $_REQUEST['group']; | |
| 86 | - if ( Groups_Group::read( $group_id ) ) { | |
| 87 | - $group = new Groups_Group( $group_id ); | |
| 88 | - $users = $group->users; | |
| 89 | - $include = array(); | |
| 90 | - if ( count( $users ) > 0 ) { | |
| 91 | - foreach( $users as $user ) { | |
| 92 | - $include[] = $user->user->ID; | |
| 93 | - } | |
| 94 | - } else { // no results | |
| 95 | - $include[] = 0; | |
| 90 | + if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) { | |
| 91 | + $filter_group_ids = groups_sanitize_request( 'filter_group_ids' ); | |
| 92 | + if ( is_array( $filter_group_ids ) ) { | |
| 93 | + $group_ids = array(); | |
| 94 | + foreach ( $filter_group_ids as $group_id ) { | |
| 95 | + $group_id = Groups_Utility::id( $group_id ); | |
| 96 | + if ( $group_id !== false ) { | |
| 97 | + $group_ids[] = $group_id; | |
| 96 | 98 | } |
| 97 | - $ids = implode( ',', wp_parse_id_list( $include ) ); | |
| 98 | - $user_query->query_where .= " AND $wpdb->users.ID IN ($ids)"; | |
| 99 | 99 | } |
| 100 | + $n = count( $group_ids ); | |
| 101 | + if ( $n > 0 ) { | |
| 102 | + $user_group_table = _groups_get_tablename( 'user_group' ); | |
| 103 | + $group_ids = implode( ',', esc_sql( $group_ids ) ); | |
| 104 | + $conjunctive = !empty( groups_sanitize_request( 'filter_groups_conjunctive' ) ); | |
| 105 | + if ( !$conjunctive ) { | |
| 106 | + $user_query->query_where .= " AND $wpdb->users.ID IN ( SELECT DISTINCT user_id FROM $user_group_table WHERE group_id IN ( $group_ids ) ) "; | |
| 107 | + } else { | |
| 108 | + $user_query->query_where .= | |
| 109 | + " AND $wpdb->users.ID IN ( " . | |
| 110 | + "SELECT user_id FROM ( " . | |
| 111 | + "SELECT user_id, COUNT( group_id ) AS n FROM $user_group_table WHERE group_id IN ( $group_ids ) GROUP BY user_id " . | |
| 112 | + ") group_counts WHERE n = " . intval( $n ) . | |
| 113 | + ") "; | |
| 114 | + } | |
| 115 | + } | |
| 100 | 116 | } |
| 101 | 117 | } |
| 102 | 118 | return $user_query; |
| 103 | 119 | } |
| @@ -108,10 +124,11 @@ | ||
| 108 | 124 | public static function admin_enqueue_scripts() { |
| 109 | 125 | |
| 110 | 126 | global $pagenow; |
| 111 | 127 | |
| 112 | - if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) { | |
| 128 | + if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) { | |
| 113 | 129 | Groups_UIE::enqueue( 'select' ); |
| 130 | + wp_enqueue_style( 'groups_admin_user' ); | |
| 114 | 131 | } |
| 115 | 132 | } |
| 116 | 133 | |
| 117 | 134 | /** |
| @@ -120,29 +137,10 @@ | ||
| 120 | 137 | public static function admin_head() { |
| 121 | 138 | |
| 122 | 139 | global $pagenow; |
| 123 | 140 | |
| 124 | - if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) { | |
| 125 | - | |
| 126 | - // .subsubsub rule added because with views_users() the list can get long | |
| 127 | - // icon distinguishes from role links | |
| 128 | - echo '<style type="text/css">'; | |
| 129 | - echo '.subsubsub { white-space: normal; }'; | |
| 130 | - echo 'a.group { background: url(' . GROUPS_PLUGIN_URL . '/images/groups-grey-8x8.png) transparent no-repeat left center; padding-left: 10px;}'; | |
| 131 | - echo '</style>'; | |
| 132 | - | |
| 133 | - // group-actions | |
| 134 | - echo '<style type="text/css">'; | |
| 135 | - echo '.groups-bulk-container { display: inline-block; line-height: 24px; padding-bottom: 1em; vertical-align: top; margin-left: 1em; margin-right: 1em; }'; | |
| 136 | - echo '.groups-bulk-container .groups-select-container { display: inline-block; vertical-align: top; }'; | |
| 137 | - echo '.groups-bulk-container .groups-select-container select, .groups-bulk-container select.groups-action { float: none; margin-right: 4px; vertical-align: top; }'; | |
| 138 | - echo '.groups-bulk-container .selectize-control { min-width: 128px; }'; | |
| 139 | - echo '.groups-bulk-container .selectize-control, .groups-bulk-container select.groups-action { margin-right: 4px; vertical-align: top; }'; | |
| 140 | - echo '.groups-bulk-container .selectize-input { font-size: inherit; line-height: 18px; padding: 1px 2px 2px 2px; vertical-align: middle; }'; | |
| 141 | - echo '.groups-bulk-container .selectize-input input[type="text"] { font-size: inherit; vertical-align: middle; height: 24px; }'; | |
| 142 | - echo '.groups-bulk-container input.button { margin-top: 1px; vertical-align: top; }'; | |
| 143 | - echo '.tablenav .actions { overflow: visible; }'; // this is important so that the selectize options aren't hidden | |
| 144 | - echo '</style>'; | |
| 141 | + if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) { | |
| 142 | + // @since 2.18.0 moved to groups_admin_user.css | |
| 145 | 143 | } |
| 146 | 144 | } |
| 147 | 145 | |
| 148 | 146 | /** |
| @@ -160,24 +158,29 @@ | ||
| 160 | 158 | } |
| 161 | 159 | |
| 162 | 160 | $output = ''; |
| 163 | 161 | |
| 164 | - if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) { | |
| 165 | - $group_table = _groups_get_tablename( "group" ); | |
| 162 | + if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) { | |
| 166 | 163 | // groups select |
| 167 | 164 | $groups_table = _groups_get_tablename( 'group' ); |
| 168 | - if ( $groups = $wpdb->get_results( "SELECT * FROM $groups_table ORDER BY name" ) ) { | |
| 165 | + $groups = apply_filters( 'groups_admin_users_restrict_manage_users_groups', $wpdb->get_results( "SELECT * FROM $groups_table ORDER BY name" ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 166 | + $groups_select = ''; | |
| 167 | + if ( $groups ) { | |
| 169 | 168 | $groups_select = sprintf( |
| 170 | 169 | '<select id="user-groups" class="groups" name="group_ids[]" multiple="multiple" placeholder="%s" data-placeholder="%s">', |
| 171 | - esc_attr( __( 'Choose groups …', GROUPS_PLUGIN_DOMAIN ) ) , | |
| 172 | - esc_attr( __( 'Choose groups …', GROUPS_PLUGIN_DOMAIN ) ) | |
| 170 | + esc_attr__( 'Choose groups …', 'groups' ), | |
| 171 | + esc_attr__( 'Choose groups …', 'groups' ) | |
| 173 | 172 | ); |
| 174 | - foreach( $groups as $group ) { | |
| 173 | + foreach ( $groups as $group ) { | |
| 175 | 174 | $is_member = false; |
| 176 | - $groups_select .= sprintf( '<option value="%d" %s>%s</option>', Groups_Utility::id( $group->group_id ), $is_member ? ' selected="selected" ' : '', wp_filter_nohtml_kses( $group->name ) ); | |
| 175 | + $groups_select .= sprintf( | |
| 176 | + '<option value="%d" %s>%s</option>', | |
| 177 | + Groups_Utility::id( $group->group_id ), | |
| 178 | + $is_member ? ' selected="selected" ' : '', | |
| 179 | + $group->name ? stripslashes( wp_filter_nohtml_kses( $group->name ) ) : '' | |
| 180 | + ); | |
| 177 | 181 | } |
| 178 | 182 | $groups_select .= '</select>'; |
| 179 | - | |
| 180 | 183 | } |
| 181 | 184 | |
| 182 | 185 | // group bulk actions added through extra_tablenav() |
| 183 | 186 | $box = '<div id="group-bulk-actions" class="groups-bulk-container">'; |
| @@ -184,13 +187,13 @@ | ||
| 184 | 187 | $box .= '<div class="groups-select-container">'; |
| 185 | 188 | $box .= $groups_select; |
| 186 | 189 | $box .= '</div>'; |
| 187 | 190 | $box .= '<select class="groups-action" name="groups-action">'; |
| 188 | - $box .= '<option selected="selected" value="-1">' . __( 'Group Actions', GROUPS_PLUGIN_DOMAIN ) . '</option>'; | |
| 189 | - $box .= '<option value="add-group">' . __( 'Add to group', GROUPS_PLUGIN_DOMAIN ) . '</option>'; | |
| 190 | - $box .= '<option value="remove-group">' . __( 'Remove from group', GROUPS_PLUGIN_DOMAIN ) . '</option>'; | |
| 191 | + $box .= '<option selected="selected" value="-1">' . esc_html__( 'Group Actions', 'groups' ) . '</option>'; | |
| 192 | + $box .= '<option value="add-group">' . esc_html__( 'Add to group', 'groups' ) . '</option>'; | |
| 193 | + $box .= '<option value="remove-group">' . esc_html__( 'Remove from group', 'groups' ) . '</option>'; | |
| 191 | 194 | $box .= '</select>'; |
| 192 | - $box .= sprintf( '<input class="button" type="submit" name="groups" value="%s" />', __( 'Apply', GROUPS_PLUGIN_DOMAIN ) ); | |
| 195 | + $box .= sprintf( '<input class="button" type="submit" name="groups" value="%s" />', esc_attr__( 'Apply', 'groups' ) ); | |
| 193 | 196 | $box .= '</div>'; |
| 194 | 197 | $box = str_replace( '"', "'", $box ); |
| 195 | 198 | |
| 196 | 199 | $nonce = wp_nonce_field( 'user-group', 'bulk-user-group-nonce', true, false ); |
| @@ -197,48 +200,84 @@ | ||
| 197 | 200 | $nonce = str_replace( '"', "'", $nonce ); |
| 198 | 201 | $box .= $nonce; |
| 199 | 202 | |
| 200 | 203 | $box .= '<script type="text/javascript">'; |
| 204 | + $box .= 'document.addEventListener( "DOMContentLoaded", function() {'; | |
| 201 | 205 | $box .= 'if ( typeof jQuery !== "undefined" ) {'; |
| 202 | - $box .= 'jQuery("document").ready(function(){'; | |
| 203 | 206 | $box .= 'jQuery(".tablenav.top .alignleft.actions:last").after("<div id=\"groups-bulk-actions-block\" class=\"alignleft actions\"></div>");'; |
| 204 | 207 | $box .= 'jQuery("#group-bulk-actions").appendTo(jQuery("#groups-bulk-actions-block"));'; |
| 205 | - $box .= '});'; | |
| 206 | - $box .= '}'; | |
| 208 | + $box .= '}'; // jQuery | |
| 209 | + $box .= '} );'; // document.... | |
| 207 | 210 | $box .= '</script>'; |
| 208 | 211 | |
| 209 | 212 | $output .= $box; |
| 210 | 213 | $output .= Groups_UIE::render_select( '#user-groups' ); |
| 211 | 214 | } |
| 212 | - echo $output; | |
| 215 | + echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped | |
| 213 | 216 | } |
| 214 | 217 | |
| 215 | 218 | /** |
| 216 | - * Hooked on filter in class-wp-list-table.php to add links that | |
| 217 | - * filter by group. | |
| 219 | + * Hooked on filter in class-wp-list-table.php to filter by group. | |
| 220 | + * | |
| 218 | 221 | * @param array $views |
| 222 | + * | |
| 223 | + * @return array views | |
| 219 | 224 | */ |
| 220 | 225 | public static function views_users( $views ) { |
| 221 | 226 | global $pagenow, $wpdb; |
| 222 | - if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) { | |
| 223 | - $group_table = _groups_get_tablename( "group" ); | |
| 224 | - $user_group_table = _groups_get_tablename( "user_group" ); | |
| 225 | - $groups = $wpdb->get_results( "SELECT * FROM $group_table ORDER BY name" ); | |
| 226 | - foreach( $groups as $group ) { | |
| 227 | - $group = new Groups_Group( $group->group_id ); | |
| 227 | + if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) { | |
| 228 | + $output = '<form id="filter-groups-form" action="" method="get">'; | |
| 229 | + $output .= '<div class="groups-filter-container">'; | |
| 230 | + $output .= '<div class="groups-select-container">'; | |
| 231 | + $output .= sprintf( | |
| 232 | + '<select id="filter-groups" class="groups" name="filter_group_ids[]" multiple="multiple" placeholder="%s" data-placeholder="%s">', | |
| 233 | + esc_attr__( 'Choose groups …', 'groups' ), | |
| 234 | + esc_attr__( 'Choose groups …', 'groups' ) | |
| 235 | + ); | |
| 236 | + $user_group_table = _groups_get_tablename( 'user_group' ); | |
| 237 | + $groups = apply_filters( 'groups_admin_users_views_users_groups', Groups_Group::get_groups( array( 'order_by' => 'name', 'order' => 'ASC' ) ) ); | |
| 238 | + $user_counts = array(); | |
| 239 | + $counts = apply_filters('groups_admin_users_views_users_counts', $wpdb->get_results( "SELECT COUNT(user_id) AS count, group_id FROM $user_group_table GROUP BY group_id" ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 240 | + if ( !empty( $counts ) && is_array( $counts ) ) { | |
| 241 | + foreach ( $counts as $count ) { | |
| 242 | + if ( isset( $count->count ) && is_numeric( $count->count ) ) { | |
| 243 | + $user_counts[$count->group_id] = max( 0, intval( $count->count ) ); | |
| 244 | + } | |
| 245 | + } | |
| 246 | + } | |
| 247 | + $filter_group_ids = groups_sanitize_request( 'filter_group_ids' ); | |
| 248 | + if ( !is_array( $filter_group_ids ) ) { | |
| 249 | + $filter_group_ids = array(); | |
| 250 | + } | |
| 251 | + foreach ( $groups as $group ) { | |
| 228 | 252 | // Do not use $user_count = count( $group->users ); here, |
| 229 | 253 | // as it creates a lot of unneccessary objects and can lead |
| 230 | 254 | // to out of memory issues on large user bases. |
| 231 | - $user_count = $wpdb->get_var( $wpdb->prepare( | |
| 232 | - "SELECT COUNT(user_id) FROM $user_group_table WHERE group_id = %d", | |
| 233 | - Groups_Utility::id( $group->group_id ) ) ); | |
| 234 | - $views[] = sprintf( | |
| 235 | - '<a class="group" href="%s" title="%s">%s</a>', | |
| 236 | - esc_url( add_query_arg( 'group', $group->group_id, admin_url( 'users.php' ) ) ), | |
| 237 | - sprintf( '%s Group', wp_filter_nohtml_kses( $group->name ) ), | |
| 238 | - sprintf( '%s <span class="count">(%s)</span>', wp_filter_nohtml_kses( $group->name ), $user_count ) | |
| 255 | + $user_count = isset( $user_counts[$group->group_id] ) ? $user_counts[$group->group_id] : 0; | |
| 256 | + $selected = in_array( $group->group_id, $filter_group_ids ); | |
| 257 | + $output .= sprintf( | |
| 258 | + '<option value="%d" %s>%s</option>', | |
| 259 | + Groups_Utility::id( $group->group_id ), | |
| 260 | + $selected ? ' selected="selected" ' : '', | |
| 261 | + sprintf( | |
| 262 | + '%s <span class="count">(%s)</span>', | |
| 263 | + $group->name ? stripslashes( wp_filter_nohtml_kses( $group->name ) ) : '', | |
| 264 | + esc_html( $user_count ) | |
| 265 | + ) | |
| 239 | 266 | ); |
| 240 | 267 | } |
| 268 | + $output .= '</select>'; | |
| 269 | + $output .= '</div>'; // .groups-select-container | |
| 270 | + $output .= '</div>'; // .groups-filter-container | |
| 271 | + $conjunctive = !empty( groups_sanitize_request( 'filter_groups_conjunctive' ) ); | |
| 272 | + $output .= sprintf( '<label title="%s" style="margin-right: 4px;">', esc_html_x( 'Users must belong to all chosen groups', 'label title for conjunctive groups filter checkbox', 'groups' ) ); | |
| 273 | + $output .= sprintf( '<input class="filter-groups-conjunctive" name="filter_groups_conjunctive" type="checkbox" value="1" %s />', $conjunctive ? ' checked="checked" ' : '' ); | |
| 274 | + $output .= esc_html_x( '∩', 'label for conjunctive groups filter checkbox', 'groups' ); | |
| 275 | + $output .= '</label>'; | |
| 276 | + $output .= '<input class="button" style="vertical-align:middle" type="submit" value="' . esc_attr__( 'Filter', 'groups' ) . '"/>'; | |
| 277 | + $output .= '</form>'; | |
| 278 | + $output .= Groups_UIE::render_select( '#filter-groups' ); | |
| 279 | + $views['groups'] = $output; | |
| 241 | 280 | } |
| 242 | 281 | return $views; |
| 243 | 282 | } |
| 244 | 283 | |
| @@ -245,26 +284,28 @@ | ||
| 245 | 284 | /** |
| 246 | 285 | * Adds or removes users to/from groups. |
| 247 | 286 | */ |
| 248 | 287 | public static function load_users() { |
| 249 | - if ( current_user_can( GROUPS_ADMINISTER_GROUPS ) ) { | |
| 250 | - $users = isset( $_REQUEST['users'] ) ? $_REQUEST['users'] : null; | |
| 288 | + if ( Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) { | |
| 289 | + $users = groups_sanitize_request( 'users' ); | |
| 251 | 290 | $action = null; |
| 252 | - if ( !empty( $_REQUEST['groups'] ) ) { | |
| 253 | - if ( $_GET['groups-action'] == "add-group" ) { | |
| 291 | + if ( !empty( $_REQUEST['groups'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 292 | + if ( groups_sanitize_get( 'groups-action' ) === 'add-group' ) { | |
| 254 | 293 | $action = 'add'; |
| 255 | - } else if ( $_GET['groups-action'] == "remove-group" ) { | |
| 294 | + } else if ( groups_sanitize_get( 'groups-action' ) === 'remove-group' ) { | |
| 256 | 295 | $action = 'remove'; |
| 257 | 296 | } |
| 258 | 297 | } |
| 259 | - if ( $users !== null && $action !== null ) { | |
| 260 | - if ( wp_verify_nonce( $_REQUEST['bulk-user-group-nonce'], 'user-group' ) ) { | |
| 261 | - foreach( $users as $user_id ) { | |
| 298 | + if ( $users !== null && $action !== null && is_array( $users ) ) { | |
| 299 | + $users = array_map( 'intval', $users ); | |
| 300 | + if ( groups_verify_request_nonce( 'bulk-user-group-nonce', 'user-group' ) ) { | |
| 301 | + foreach ( $users as $user_id ) { | |
| 262 | 302 | switch ( $action ) { |
| 263 | 303 | case 'add': |
| 264 | - $group_ids = isset( $_GET['group_ids'] ) ? $_GET['group_ids'] : null; | |
| 265 | - if ( $group_ids !== null ) { | |
| 304 | + $group_ids = groups_sanitize_get( 'group_ids' ); | |
| 305 | + if ( $group_ids !== null && is_array( $group_ids ) ) { | |
| 266 | 306 | foreach ( $group_ids as $group_id ) { |
| 307 | + // Do NOT use Groups_User::user_is_member( ... ) here, as this must not be filtered: | |
| 267 | 308 | if ( !Groups_User_Group::read( $user_id, $group_id ) ) { |
| 268 | 309 | Groups_User_Group::create( |
| 269 | 310 | array( |
| 270 | 311 | 'user_id' => $user_id, |
| @@ -275,11 +316,12 @@ | ||
| 275 | 316 | } |
| 276 | 317 | } |
| 277 | 318 | break; |
| 278 | 319 | case 'remove': |
| 279 | - $group_ids = isset( $_GET['group_ids'] ) ? $_GET['group_ids'] : null; | |
| 280 | - if ( $group_ids !== null ) { | |
| 320 | + $group_ids = groups_sanitize_get( 'group_ids' ); | |
| 321 | + if ( $group_ids !== null && is_array( $group_ids ) ) { | |
| 281 | 322 | foreach ( $group_ids as $group_id ) { |
| 323 | + // Do NOT use Groups_User::user_is_member( ... ) here, as this must not be filtered: | |
| 282 | 324 | if ( Groups_User_Group::read( $user_id, $group_id ) ) { |
| 283 | 325 | Groups_User_Group::delete( $user_id, $group_id ); |
| 284 | 326 | } |
| 285 | 327 | } |
| @@ -288,10 +330,10 @@ | ||
| 288 | 330 | } |
| 289 | 331 | } |
| 290 | 332 | $referer = wp_get_referer(); |
| 291 | 333 | if ( $referer ) { |
| 292 | - $redirect_to = remove_query_arg( array( 'action', 'action2', 'add-to-group', 'bulk-user-group-nonce', 'group_id', 'new_role', 'remove-from-group', 'users' ), $referer ); | |
| 293 | - wp_redirect( $redirect_to ); | |
| 334 | + $redirect_to = remove_query_arg( array( 'action', 'action2', 'add-to-group', 'bulk-user-group-nonce', 'group_id', 'new_role', 'remove-from-group', 'users', 'update', 'id' ), $referer ); | |
| 335 | + wp_safe_redirect( $redirect_to ); | |
| 294 | 336 | exit; |
| 295 | 337 | } |
| 296 | 338 | } |
| 297 | 339 | } |
| @@ -298,25 +340,26 @@ | ||
| 298 | 340 | } |
| 299 | 341 | } |
| 300 | 342 | |
| 301 | 343 | /** |
| 302 | - * Adds a new column to the users table to show the groups that users | |
| 303 | - * belong to. | |
| 304 | - * | |
| 344 | + * Adds a new column to the users table to show the groups that users belong to. | |
| 345 | + * | |
| 305 | 346 | * @param array $column_headers |
| 347 | + * | |
| 306 | 348 | * @return array column headers |
| 307 | 349 | */ |
| 308 | 350 | public static function manage_users_columns( $column_headers ) { |
| 309 | - $column_headers[self::GROUPS] = __( 'Groups', GROUPS_PLUGIN_DOMAIN ); | |
| 351 | + $column_headers[self::GROUPS] = _x( 'Groups', 'Column header (Users)', 'groups' ); | |
| 310 | 352 | return $column_headers; |
| 311 | 353 | } |
| 312 | 354 | |
| 313 | 355 | /** |
| 314 | 356 | * Renders custom column content. |
| 315 | - * | |
| 316 | - * @param string $output | |
| 357 | + * | |
| 358 | + * @param string $output | |
| 317 | 359 | * @param string $column_name |
| 318 | 360 | * @param int $user_id |
| 361 | + * | |
| 319 | 362 | * @return string custom column content |
| 320 | 363 | */ |
| 321 | 364 | public static function manage_users_custom_column( $output, $column_name, $user_id ) { |
| 322 | 365 | switch ( $column_name ) { |
| @@ -321,20 +364,20 @@ | ||
| 321 | 364 | public static function manage_users_custom_column( $output, $column_name, $user_id ) { |
| 322 | 365 | switch ( $column_name ) { |
| 323 | 366 | case self::GROUPS : |
| 324 | 367 | $groups_user = new Groups_User( $user_id ); |
| 325 | - $groups = $groups_user->groups; | |
| 326 | - if ( count( $groups ) > 0 ) { | |
| 368 | + $groups = $groups_user->get_groups(); | |
| 369 | + if ( $groups !== null && count( $groups ) > 0 ) { | |
| 327 | 370 | usort( $groups, array( __CLASS__, 'by_group_name' ) ); |
| 328 | 371 | $output = '<ul>'; |
| 329 | - foreach( $groups as $group ) { | |
| 372 | + foreach ( $groups as $group ) { | |
| 330 | 373 | $output .= '<li>'; |
| 331 | - $output .= wp_filter_nohtml_kses( $group->name ); | |
| 374 | + $output .= $group->get_name() ? stripslashes( wp_filter_nohtml_kses( $group->get_name() ) ) : ''; | |
| 332 | 375 | $output .= '</li>'; |
| 333 | 376 | } |
| 334 | 377 | $output .= '</ul>'; |
| 335 | 378 | } else { |
| 336 | - $output .= __( '--', GROUPS_PLUGIN_DOMAIN ); | |
| 379 | + $output .= esc_html__( '--', 'groups' ); | |
| 337 | 380 | } |
| 338 | 381 | break; |
| 339 | 382 | } |
| 340 | 383 | return $output; |
| @@ -341,13 +384,15 @@ | ||
| 341 | 384 | } |
| 342 | 385 | |
| 343 | 386 | /** |
| 344 | 387 | * usort helper |
| 388 | + * | |
| 345 | 389 | * @param Groups_Group $o1 |
| 346 | 390 | * @param Groups_Group $o2 |
| 391 | + * | |
| 347 | 392 | * @return int strcmp result for group names |
| 348 | 393 | */ |
| 349 | 394 | public static function by_group_name( $o1, $o2 ) { |
| 350 | - return strcmp( $o1->name, $o2->name ); | |
| 395 | + return strcmp( $o1->get_name(), $o2->get_name() ); | |
| 351 | 396 | } |
| 352 | 397 | } |
| 353 | 398 | Groups_Admin_Users::init(); |
