wordpress-seo / admin / capabilities / class-register-capabilities.php

class-register-capabilities.php in Yoast SEO – Advanced SEO with real-time guidance and built-in AI 28.5, at admin/capabilities/class-register-capabilities.php

116 lines 3.2 KB

Raw Download Zip

1	<?php
2	/**
3	* WPSEO plugin file.
4	*
5	* @package WPSEO\Admin\Capabilities
6	*/
7
8	/**
9	* Capabilities registration class.
10	*/
11	class WPSEO_Register_Capabilities implements WPSEO_WordPress_Integration {
12
13	/**
14	* Registers the hooks.
15	*
16	* @return void
17	*/
18	public function register_hooks() {
19	add_action( 'wpseo_register_capabilities', [ $this, 'register' ] );
20
21	if ( is_multisite() ) {
22	add_action( 'user_has_cap', [ $this, 'filter_user_has_wpseo_manage_options_cap' ], 10, 4 );
23	}
24
25	/**
26	* Maybe add manage_privacy_options capability for wpseo_manager user role.
27	*/
28	add_filter( 'map_meta_cap', [ $this, 'map_meta_cap_for_seo_manager' ], 10, 2 );
29	}
30
31	/**
32	* Registers the capabilities.
33	*
34	* @return void
35	*/
36	public function register() {
37	$manager = WPSEO_Capability_Manager_Factory::get();
38
39	$manager->register( 'wpseo_bulk_edit', [ 'editor', 'wpseo_editor', 'wpseo_manager' ] );
40	$manager->register( 'wpseo_edit_advanced_metadata', [ 'editor', 'wpseo_editor', 'wpseo_manager' ] );
41
42	$manager->register( 'wpseo_manage_options', [ 'administrator', 'wpseo_manager' ] );
43	$manager->register( 'view_site_health_checks', [ 'wpseo_manager' ] );
44	}
45
46	/**
47	* Revokes the 'wpseo_manage_options' capability from administrator users if it should
48	* only be granted to network administrators.
49	*
50	* @param array $allcaps An array of all the user's capabilities.
51	* @param array $caps Actual capabilities being checked.
52	* @param array $args Optional parameters passed to has_cap(), typically object ID.
53	* @param WP_User $user The user object.
54	*
55	* @return array Possibly modified array of the user's capabilities.
56	*/
57	public function filter_user_has_wpseo_manage_options_cap( $allcaps, $caps, $args, $user ) {
58
59	// We only need to do something if 'wpseo_manage_options' is being checked.
60	if ( ! in_array( 'wpseo_manage_options', $caps, true ) ) {
61	return $allcaps;
62	}
63
64	// If the user does not have 'wpseo_manage_options' anyway, we don't need to revoke access.
65	if ( empty( $allcaps['wpseo_manage_options'] ) ) {
66	return $allcaps;
67	}
68
69	// If the user does not have 'delete_users', they are not an administrator.
70	if ( empty( $allcaps['delete_users'] ) ) {
71	return $allcaps;
72	}
73
74	$options = WPSEO_Options::get_instance();
75
76	if ( $options->get( 'access' ) === 'superadmin' && ! is_super_admin( $user->ID ) ) {
77	unset( $allcaps['wpseo_manage_options'] );
78	}
79
80	return $allcaps;
81	}
82
83	/**
84	* Maybe add manage_privacy_options capability for wpseo_manager user role.
85	*
86	* @param string[] $caps Primitive capabilities required of the user.
87	* @param string[] $cap Capability being checked.
88	*
89	* @return string[] Filtered primitive capabilities required of the user.
90	*/
91	public function map_meta_cap_for_seo_manager( $caps, $cap ) {
92	$user = wp_get_current_user();
93
94	// No multisite support.
95	if ( is_multisite() ) {
96	return $caps;
97	}
98
99	if ( ! is_array( $user->roles ) ) {
100	return $caps;
101	}
102
103	// User must be of role wpseo_manager.
104	if ( ! in_array( 'wpseo_manager', $user->roles, true ) ) {
105	return $caps;
106	}
107
108	// Remove manage_options cap requirement if requested cap is manage_privacy_options.
109	if ( $cap === 'manage_privacy_options' ) {
110	return array_diff( $caps, [ 'manage_options' ] );
111	}
112
113	return $caps;
114	}
115	}
116