groups / lib / admin / groups-admin-capabilities-add.php

groups-admin-capabilities-add.php in Groups – Memberships and Access Control trunk, at lib/admin/groups-admin-capabilities-add.php

110 lines 4.7 KB

Raw Download Zip

1	<?php
2	/**
3	* groups-admin-capabilities-add.php
4	*
5	* Copyright (c) "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.0.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	/**
27	* Show add capability form.
28	*/
29	function groups_admin_capabilities_add() {
30
31	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
32	wp_die( esc_html__( 'Access denied.', 'groups' ) );
33	}
34
35	$current_url = groups_get_current_url();
36	$current_url = remove_query_arg( 'paged', $current_url );
37	$current_url = remove_query_arg( 'action', $current_url );
38	$current_url = remove_query_arg( 'capability_id', $current_url );
39
40	$capability = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
41	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
42
43	$output = '<div class="manage-capabilities wrap">';
44	$output .= '<h1>';
45	$output .= esc_html__( 'Add a new capability', 'groups' );
46	$output .= '</h1>';
47	$output .= Groups_Admin::render_messages();
48	$output .= '<form id="add-capability" action="' . esc_url( $current_url ) . '" method="post">';
49	$output .= '<div class="capability new">';
50
51	$output .= '<div class="field">';
52	$output .= sprintf( '<label for="capability-field" class="field-label first required">%s</label>', esc_html__( 'Capability', 'groups' ) );
53	$output .= sprintf(
54	'<input id="name-field" name="capability-field" class="capability-field" type="text" value="%s"/>',
55	esc_attr( stripslashes( $capability ) )
56	);
57	$output .= '</div>';
58
59	$output .= '<div class="field">';
60	$output .= sprintf( '<label for="description-field" class="field-label description-field">%s</label>', esc_html__( 'Description', 'groups' ) );
61	$output .= sprintf(
62	'<textarea id="description-field" name="description-field" rows="5" cols="45">%s</textarea>',
63	stripslashes( wp_filter_nohtml_kses( $description ) )
64	);
65	$output .= '</div>';
66
67	$output .= '<div class="field">';
68	$output .= wp_nonce_field( 'capabilities-add', GROUPS_ADMIN_GROUPS_NONCE, true, false );
69	$output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Add', 'groups' ) );
70	$output .= '<input type="hidden" value="add" name="action"/>';
71	$output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
72	$output .= '</div>';
73	$output .= '</div>'; // .capability.new
74	$output .= '</form>';
75	$output .= '</div>'; // .manage-capabilities
76
77	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
78
79	} // function groups_admin_capabilities_add
80
81	/**
82	* Handle add capability form submission.
83	*
84	* @return int new capability's id or false if unsuccessful
85	*/
86	function groups_admin_capabilities_add_submit() {
87
88	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
89	wp_die( esc_html__( 'Access denied.', 'groups' ) );
90	}
91
92	if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'capabilities-add' ) ) {
93	wp_die( esc_html__( 'Access denied.', 'groups' ) );
94	}
95
96	$capability = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
97	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
98
99	$capability_id = Groups_Capability::create( compact( "capability", "description" ) );
100	if ( !$capability_id ) {
101	if ( empty( $capability ) ) {
102	Groups_Admin::add_message( __( 'The <em>Capability</em> must not be empty.', 'groups' ), 'error' );
103	} else if ( Groups_Capability::read_by_capability( $capability ) ) {
104	/* translators: capability name */
105	Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability already exists.', 'groups' ), stripslashes( wp_filter_nohtml_kses( ( $capability ) ) ) ), 'error' );
106	}
107	}
108	return $capability_id;
109	} // function groups_admin_capabilities_add_submit
110