groups / lib / admin / groups-admin-capabilities-edit.php

groups-admin-capabilities-edit.php in Groups – Memberships and Access Control trunk, at lib/admin/groups-admin-capabilities-edit.php

142 lines 6.4 KB

Raw Download Zip

1	<?php
2	/**
3	* groups-admin-capability-edit.php
4	*
5	* Copyright (c) "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.0.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	/**
27	* Show edit capability form.
28	*
29	* @param int $capability_id capability id
30	*/
31	function groups_admin_capabilities_edit( $capability_id ) {
32
33	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
34	wp_die( esc_html__( 'Access denied.', 'groups' ) );
35	}
36
37	$capability = Groups_Capability::read( intval( $capability_id ) );
38
39	if ( empty( $capability ) ) { // @phpstan-ignore empty.variable
40	wp_die( esc_html__( 'No such capability.', 'groups' ) );
41	}
42
43	$current_url = groups_get_current_url();
44	$current_url = remove_query_arg( 'action', $current_url );
45	$current_url = remove_query_arg( 'capability_id', $current_url );
46
47	$capability_capability = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : ( $capability->capability !== null ? $capability->capability : '' ); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
48	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ( $capability->description !==null ? $capability->description : '' ); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
49
50	$capability_readonly = ( $capability->capability !== Groups_Post_Access::READ_POST_CAPABILITY ) ? "" : ' readonly="readonly" ';
51
52	$output = '<div class="manage-capabilities wrap">';
53	$output .= '<h1>';
54	$output .= esc_html__( 'Edit a capability', 'groups' );
55	$output .= '</h1>';
56
57	$output .= Groups_Admin::render_messages();
58
59	$output .= sprintf( '<form id="edit-capability" action="%s" method="post">', esc_url( $current_url ) );
60	$output .= '<div class="capability edit">';
61	$output .= sprintf( '<input id="capability-id-field" name="capability-id-field" type="hidden" value="%s"/>', esc_attr( intval( $capability_id ) ) );
62
63	$output .= '<div class="field">';
64	$output .= sprintf( '<label for="capability-field" class="field-label first required">%s</label>', esc_html__( 'Capability', 'groups' ) );
65	$output .= sprintf(
66	'<input %s id="capability-field" name="capability-field" class="capability-field" type="text" value="%s"/>',
67	$capability_readonly,
68	esc_attr( stripslashes( $capability_capability ) )
69	);
70	$output .= '</div>';
71
72	$output .= '<div class="field">';
73	$output .= sprintf( '<label for="description-field" class="field-label description-field">%s</label>', esc_html__( 'Description', 'groups' ) );
74	$output .= sprintf( '<textarea id="description-field" name="description-field" rows="5" cols="45">%s</textarea>', stripslashes( wp_filter_nohtml_kses( $description ) ) );
75	$output .= '</div>';
76
77	$output .= '<div class="field">';
78	$output .= wp_nonce_field( 'capabilities-edit', GROUPS_ADMIN_GROUPS_NONCE, true, false );
79	$output .= sprintf( '<input class="button button-primary" type="submit" value="%s"/>', esc_attr__( 'Save', 'groups' ) );
80	$output .= '<input type="hidden" value="edit" name="action"/>';
81	$output .= sprintf( '<a class="cancel button" href="%s">%s</a>', esc_url( $current_url ), esc_html__( 'Cancel', 'groups' ) );
82	$output .= '</div>';
83	$output .= '</div>'; // .capability.edit
84	$output .= '</form>';
85	$output .= '</div>'; // .manage-capabilities
86
87	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
88	} // function groups_admin_capabilities_edit
89
90	/**
91	* Handle edit form submission.
92	*
93	* @return int\|boolean the capability ID if it was updated, otherwise false
94	*/
95	function groups_admin_capabilities_edit_submit() {
96
97	$result = false;
98
99	if ( !Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
100	wp_die( esc_html__( 'Access denied.', 'groups' ) );
101	}
102
103	if ( !groups_verify_post_nonce( GROUPS_ADMIN_GROUPS_NONCE, 'capabilities-edit' ) ) {
104	wp_die( esc_html__( 'Access denied.', 'groups' ) );
105	}
106
107	$capability_id = groups_sanitize_post( 'capability-id-field' );
108	$capability = Groups_Capability::read( $capability_id );
109	if ( $capability ) {
110	$capability = new Groups_Capability( $capability_id );
111	$capability_id = $capability->get_capability_id();
112	if ( $capability->get_capability() !== Groups_Post_Access::READ_POST_CAPABILITY ) {
113	$capability_field = isset( $_POST['capability-field'] ) ? sanitize_text_field( $_POST['capability-field'] ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
114	} else {
115	$capability_field = Groups_Post_Access::READ_POST_CAPABILITY;
116	}
117	if ( !empty( $capability_field ) ) {
118	$update = true;
119	if ( $other_capability = Groups_Capability::read_by_capability( $capability_field ) ) {
120	if ( $other_capability->capability_id != $capability_id ) {
121	/* translators: capability name */
122	Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability already exists and cannot be assigned to this one.', 'groups' ), stripslashes( wp_filter_nohtml_kses( $other_capability->capability ) ) ), 'error' );
123	$update = false;
124	}
125	}
126	if ( $update ) {
127	$description = isset( $_POST['description-field'] ) ? sanitize_textarea_field( $_POST['description-field'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
128	$capability_id = Groups_Capability::update( array( 'capability_id' => $capability_id, 'capability' => $capability_field, 'description' => $description ) );
129	if ( $capability_id ) {
130	$result = $capability_id;
131	} else {
132	/* translators: capability name */
133	Groups_Admin::add_message( sprintf( __( 'The <em>%s</em> capability could not be updated.', 'groups' ), stripslashes( wp_filter_nohtml_kses( $capability->get_capability() ) ) ), 'error' );
134	}
135	}
136	} else {
137	Groups_Admin::add_message( __( 'The <em>Capability</em> must not be empty.', 'groups' ), 'error' );
138	}
139	}
140	return $result;
141	} // function groups_admin_capabilities_edit_submit
142