| @@ -181,8 +181,16 @@ | ||
| 181 | 181 | $log->is_ip_blacklisted = ( '' !== $ip_val && in_array( $ip_val, $ip_blacklist, true ) ); |
| 182 | 182 | $log->is_ua_whitelisted = ( '' !== $ua_val && in_array( $ua_val, $ua_whitelist, true ) ); |
| 183 | 183 | $log->is_ua_blacklisted = ( '' !== $ua_val && in_array( $ua_val, $ua_blacklist, true ) ); |
| 184 | 184 | $log->request_uri = Vigilante_Activity_Log::extract_request_uri( $log->extra_data ?? '' ); |
| 185 | + // Same explanation as the first page load: without this, an entry | |
| 186 | + // reached by filtering or paginating would open a popup with less | |
| 187 | + // in it than the same entry opened from the first page. | |
| 188 | + $log->self_guidance = Vigilante_Self_Integrity_Guidance::for_log_event( | |
| 189 | + (string) ( $log->event_action ?? '' ), | |
| 190 | + $log->extra_data ?? '', | |
| 191 | + (string) ( $log->severity ?? 'info' ) | |
| 192 | + ); | |
| 185 | 193 | } |
| 186 | 194 | |
| 187 | 195 | wp_send_json_success( array( |
| 188 | 196 | 'logs' => $logs, |
| @@ -1046,12 +1054,25 @@ | ||
| 1046 | 1054 | if ( ! $user_id ) { |
| 1047 | 1055 | wp_send_json_error( __( 'Invalid user ID.', 'vigilante' ) ); |
| 1048 | 1056 | } |
| 1049 | 1057 | |
| 1050 | - // The pending flag is a user meta, shared by every site of a network, and | |
| 1051 | - // approving opens the login everywhere. Same rule the other account tools | |
| 1052 | - // got in 2.10.3: permission over that user, which on a network only a | |
| 1053 | - // network administrator has (2.11.8). | |
| 1058 | + /* | |
| 1059 | + * Permission over that account, which on a network only a network | |
| 1060 | + * administrator has (wp-includes/capabilities.php:75). Same rule the other | |
| 1061 | + * account tools got in 2.10.3, kept here in 2.11.8. | |
| 1062 | + * | |
| 1063 | + * The reason written here until 2.11.10 was that the pending flag is one | |
| 1064 | + * user meta shared by the whole network, and that stopped being true in | |
| 1065 | + * this very release: the flag is per site now and approving clears only | |
| 1066 | + * this site's. The check stays all the same, and deliberately. Approving | |
| 1067 | + * is what lets somebody into a network whose session cookie is valid on | |
| 1068 | + * every site of it, and the queue is shown to a site administrator so they | |
| 1069 | + * can see who is waiting, with the button locked and explained, which is | |
| 1070 | + * how it has behaved since 2.11.8 and what matriz-red-limpieza-2114.sh | |
| 1071 | + * checks. Loosening it is a decision about who may let people into a | |
| 1072 | + * network, not a tidy-up, so it belongs with the rest of the network | |
| 1073 | + * permissions work in 3.1.0 and not in a security release. | |
| 1074 | + */ | |
| 1054 | 1075 | if ( ! current_user_can( 'edit_user', $user_id ) ) { |
| 1055 | 1076 | wp_send_json_error( __( 'Permission denied.', 'vigilante' ) ); |
| 1056 | 1077 | } |
| 1057 | 1078 | |
