← All changes | lib/admin/groups-admin-capabilities-add.php +46 -45 1.10.1 → 4.7.1 View file →

		@@ -27,82 +27,83 @@
27	27	* Show add capability form.
28	28	*/
29	29	function groups_admin_capabilities_add() {
30	30
31		- global $wpdb;
32		-
33		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
34		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	31	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	32	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
35	33	}
36	34
37		- $current_url = ( is_ssl() ? 'https://' : 'http://' ) . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	35	+ $current_url = groups_get_current_url();
38	36	$current_url = remove_query_arg( 'paged', $current_url );
39	37	$current_url = remove_query_arg( 'action', $current_url );
40	38	$current_url = remove_query_arg( 'capability_id', $current_url );
41	39
42		- $capability = isset( $_POST['capability-field'] ) ? $_POST['capability-field'] : '';
43		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : '';
	40	+ $capability = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	41	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
44	42
45		- $capability_table = _groups_get_tablename( 'capability' );
	43	+ $output = '<div class="manage-capabilities wrap">';
	44	+ $output .= '<h1>';
	45	+ $output .= esc_html__( 'Add a new capability', 'groups' );
	46	+ $output .= '</h1>';
	47	+ $output .= Groups_Admin::render_messages();
	48	+ $output .= '<form id="add-capability" action="' . esc_url( $current_url ) . '" method="post">';
	49	+ $output .= '<div class="capability new">';
46	50
47		- $output =
48		- '<div class="manage-capabilities wrap">' .
49		- '<h1>' .
50		- __( 'Add a new capability', GROUPS_PLUGIN_DOMAIN ) .
51		- '</h1>' .
52		- Groups_Admin::render_messages() .
53		- '<form id="add-capability" action="' . esc_url( $current_url ) . '" method="post">' .
54		- '<div class="capability new">' .
	51	+ $output .= '<div class="field">';
	52	+ $output .= sprintf( '<label for="capability-field" class="field-label first required">%s</label>', esc_html__( 'Capability', 'groups' ) );
	53	+ $output .= sprintf(
	54	+ '<input id="name-field" name="capability-field" class="capability-field" type="text" value="%s"/>',
	55	+ esc_attr( stripslashes( $capability ) )
	56	+ );
	57	+ $output .= '</div>';
55	58
56		- '<div class="field">' .
57		- '<label for="capability-field" class="field-label first required">' .__( 'Capability', GROUPS_PLUGIN_DOMAIN ) . '</label>' .
58		- '<input id="name-field" name="capability-field" class="capability-field" type="text" value="' . esc_attr( stripslashes( $capability ) ) . '"/>' .
59		- '</div>' .
	59	+ $output .= '<div class="field">';
	60	+ $output .= sprintf( '<label for="description-field" class="field-label description-field">%s</label>', esc_html__( 'Description', 'groups' ) );
	61	+ $output .= sprintf(
	62	+ '<textarea id="description-field" name="description-field" rows="5" cols="45">%s</textarea>',
	63	+ stripslashes( wp_filter_nohtml_kses( $description ) )
	64	+ );
	65	+ $output .= '</div>';
60	66
61		- '<div class="field">' .
62		- '<label for="description-field" class="field-label description-field">' .__( 'Description', GROUPS_PLUGIN_DOMAIN ) . '</label>' .
63		- '<textarea id="description-field" name="description-field" rows="5" cols="45">' . stripslashes( wp_filter_nohtml_kses( $description ) ) . '</textarea>' .
64		- '</div>' .
	67	+ $output .= '<div class="field">';
	68	+ $output .= wp_nonce_field( 'capabilities-add', GROUPS_ADMIN_GROUPS_NONCE, true, false );
	69	+ $output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Add', 'groups' ) );
	70	+ $output .= '<input type="hidden" value="add" name="action"/>';
	71	+ $output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
	72	+ $output .= '</div>';
	73	+ $output .= '</div>'; // .capability.new
	74	+ $output .= '</form>';
	75	+ $output .= '</div>'; // .manage-capabilities
65	76
66		- '<div class="field">' .
67		- wp_nonce_field( 'capabilities-add', GROUPS_ADMIN_GROUPS_NONCE, true, false ) .
68		- '<input class="button button-primary" type="submit" value="' . __( 'Add', GROUPS_PLUGIN_DOMAIN ) . '"/>' .
69		- '<input type="hidden" value="add" name="action"/>' .
70		- '<a class="cancel button" href="' . esc_url( $current_url ) . '">' . __( 'Cancel', GROUPS_PLUGIN_DOMAIN ) . '</a>' .
71		- '</div>' .
72		- '</div>' . // .capability.new
73		- '</form>' .
74		- '</div>'; // .manage-capabilities
	77	+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
75	78
76		- echo $output;
77		-
78	79	} // function groups_admin_capabilities_add
79	80
80	81	/**
81	82	* Handle add capability form submission.
	83	+ *
82	84	* @return int new capability's id or false if unsuccessful
83	85	*/
84	86	function groups_admin_capabilities_add_submit() {
85	87
86		- global $wpdb;
87		-
88		- if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
89		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	88	+ if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
	89	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
90	90	}
91	91
92		- if ( !wp_verify_nonce( $_POST[GROUPS_ADMIN_GROUPS_NONCE], 'capabilities-add' ) ) {
93		- wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
	92	+ if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'capabilities-add' ) ) {
	93	+ wp_die( esc_html__( 'Access denied.', 'groups' ) );
94	94	}
95	95
96		- $capability = isset( $_POST['capability-field'] ) ? $_POST['capability-field'] : null;
97		- $description = isset( $_POST['description-field'] ) ? $_POST['description-field'] : '';
	96	+ $capability = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
	97	+ $description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
98	98
99	99	$capability_id = Groups_Capability::create( compact( "capability", "description" ) );
100	100	if ( !$capability_id ) {
101	101	if ( empty( $capability ) ) {
102		- Groups_Admin::add_message( __( 'The <em>Capability</em> must not be empty.', GROUPS_PLUGIN_DOMAIN ), 'error' );
	102	+ Groups_Admin::add_message( __( 'The <em>Capability</em> must not be empty.', 'groups' ), 'error' );
103	103	} else if ( Groups_Capability::read_by_capability( $capability ) ) {
104		- Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability already exists.', GROUPS_PLUGIN_DOMAIN ), stripslashes( wp_filter_nohtml_kses( ( $capability ) ) ) ), 'error' );
	104	+ /* translators: capability name */
	105	+ Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability already exists.', 'groups' ), stripslashes( wp_filter_nohtml_kses( ( $capability ) ) ) ), 'error' );
105	106	}
106	107	}
107	108	return $capability_id;
108	109	} // function groups_admin_capabilities_add_submit