[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Users administration panel.
   4   *
   5   * @package WordPress
   6   * @subpackage Administration
   7   */
   8  
   9  /** WordPress Administration Bootstrap */
  10  require_once ( './admin.php' );
  11  
  12  if ( ! current_user_can( 'list_users' ) )
  13      wp_die( __( 'Cheatin&#8217; uh?' ) );
  14  
  15  $wp_list_table = _get_list_table('WP_Users_List_Table');
  16  $pagenum = $wp_list_table->get_pagenum();
  17  $title = __('Users');
  18  $parent_file = 'users.php';
  19  
  20  add_screen_option( 'per_page', array('label' => _x( 'Users', 'users per page (screen options)' )) );
  21  
  22  // contextual help - choose Help on the top right of admin panel to preview this.
  23  add_contextual_help($current_screen,
  24      '<p>' . __('This screen lists all the existing users for your site. Each user has one of five defined roles as set by the site admin: Site Administrator, Editor, Author, Contributor, or Subscriber. Users with roles other than Administrator will see fewer options in the dashboard navigation when they are logged in, based on their role.') . '</p>' .
  25      '<p>' . __('You can customize the display of information on this screen as you can on other screens, by using the Screen Options tab and the on-screen filters.') . '</p>' .
  26      '<p>' . __('To add a new user for your site, click the Add New button at the top of the screen or Add New in the Users menu section.') . '</p>' .
  27      '<p><strong>' . __('For more information:') . '</strong></p>' .
  28      '<p>' . __('<a href="http://codex.wordpress.org/Users_Screen" target="_blank">Documentation on Managing Users</a>') . '</p>' .
  29      '<p>' . __('<a href="http://codex.wordpress.org/Roles_and_Capabilities" target="_blank">Descriptions of Roles and Capabilities</a>') . '</p>' .
  30      '<p>' . __('<a href="http://wordpress.org/support/" target="_blank">Support Forums</a>') . '</p>'
  31  );
  32  
  33  if ( empty($_REQUEST) ) {
  34      $referer = '<input type="hidden" name="wp_http_referer" value="'. esc_attr(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
  35  } elseif ( isset($_REQUEST['wp_http_referer']) ) {
  36      $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), stripslashes($_REQUEST['wp_http_referer']));
  37      $referer = '<input type="hidden" name="wp_http_referer" value="' . esc_attr($redirect) . '" />';
  38  } else {
  39      $redirect = 'users.php';
  40      $referer = '';
  41  }
  42  
  43  $update = '';
  44  
  45  switch ( $wp_list_table->current_action() ) {
  46  
  47  /* Bulk Dropdown menu Role changes */
  48  case 'promote':
  49      check_admin_referer('bulk-users');
  50  
  51      if ( ! current_user_can( 'promote_users' ) )
  52          wp_die( __( 'You can&#8217;t edit that user.' ) );
  53  
  54      if ( empty($_REQUEST['users']) ) {
  55          wp_redirect($redirect);
  56          exit();
  57      }
  58  
  59      $editable_roles = get_editable_roles();
  60      if ( empty( $editable_roles[$_REQUEST['new_role']] ) )
  61          wp_die(__('You can&#8217;t give users that role.'));
  62  
  63      $userids = $_REQUEST['users'];
  64      $update = 'promote';
  65      foreach ( $userids as $id ) {
  66          $id = (int) $id;
  67  
  68          if ( ! current_user_can('promote_user', $id) )
  69              wp_die(__('You can&#8217;t edit that user.'));
  70          // The new role of the current user must also have promote_users caps
  71          if ( $id == $current_user->ID && !$wp_roles->role_objects[$_REQUEST['new_role']]->has_cap('promote_users') ) {
  72              $update = 'err_admin_role';
  73              continue;
  74          }
  75  
  76          // If the user doesn't already belong to the blog, bail.
  77          if ( is_multisite() && !is_user_member_of_blog( $id ) )
  78              wp_die(__('Cheatin&#8217; uh?'));
  79  
  80          $user = new WP_User($id);
  81          $user->set_role($_REQUEST['new_role']);
  82      }
  83  
  84      wp_redirect(add_query_arg('update', $update, $redirect));
  85      exit();
  86  
  87  break;
  88  
  89  case 'dodelete':
  90      if ( is_multisite() )
  91          wp_die( __('User deletion is not allowed from this screen.') );
  92  
  93      check_admin_referer('delete-users');
  94  
  95      if ( empty($_REQUEST['users']) ) {
  96          wp_redirect($redirect);
  97          exit();
  98      }
  99  
 100      if ( ! current_user_can( 'delete_users' ) )
 101          wp_die(__('You can&#8217;t delete users.'));
 102  
 103      $userids = $_REQUEST['users'];
 104      $update = 'del';
 105      $delete_count = 0;
 106  
 107      foreach ( (array) $userids as $id) {
 108          $id = (int) $id;
 109  
 110          if ( ! current_user_can( 'delete_user', $id ) )
 111              wp_die(__( 'You can&#8217;t delete that user.' ) );
 112  
 113          if ( $id == $current_user->ID ) {
 114              $update = 'err_admin_del';
 115              continue;
 116          }
 117          switch ( $_REQUEST['delete_option'] ) {
 118          case 'delete':
 119              if ( current_user_can('delete_user', $id) )
 120                  wp_delete_user($id);
 121              break;
 122          case 'reassign':
 123              if ( current_user_can('delete_user', $id) )
 124                  wp_delete_user($id, $_REQUEST['reassign_user']);
 125              break;
 126          }
 127          ++$delete_count;
 128      }
 129  
 130      $redirect = add_query_arg( array('delete_count' => $delete_count, 'update' => $update), $redirect);
 131      wp_redirect($redirect);
 132      exit();
 133  
 134  break;
 135  
 136  case 'delete':
 137      if ( is_multisite() )
 138          wp_die( __('User deletion is not allowed from this screen.') );
 139  
 140      check_admin_referer('bulk-users');
 141  
 142      if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) {
 143          wp_redirect($redirect);
 144          exit();
 145      }
 146  
 147      if ( ! current_user_can( 'delete_users' ) )
 148          $errors = new WP_Error( 'edit_users', __( 'You can&#8217;t delete users.' ) );
 149  
 150      if ( empty($_REQUEST['users']) )
 151          $userids = array(intval($_REQUEST['user']));
 152      else
 153          $userids = (array) $_REQUEST['users'];
 154  
 155      include  ('admin-header.php');
 156  ?>
 157  <form action="" method="post" name="updateusers" id="updateusers">
 158  <?php wp_nonce_field('delete-users') ?>
 159  <?php echo $referer; ?>
 160  
 161  <div class="wrap">
 162  <?php screen_icon(); ?>
 163  <h2><?php _e('Delete Users'); ?></h2>
 164  <p><?php echo _n( 'You have specified this user for deletion:', 'You have specified these users for deletion:', count( $userids ) ); ?></p>
 165  <ul>
 166  <?php
 167      $go_delete = 0;
 168      foreach ( $userids as $id ) {
 169          $id = (int) $id;
 170          $user = new WP_User($id);
 171          if ( $id == $current_user->ID ) {
 172              echo "<li>" . sprintf(__('ID #%1s: %2s <strong>The current user will not be deleted.</strong>'), $id, $user->user_login) . "</li>\n";
 173          } else {
 174              echo "<li><input type=\"hidden\" name=\"users[]\" value=\"" . esc_attr($id) . "\" />" . sprintf(__('ID #%1s: %2s'), $id, $user->user_login) . "</li>\n";
 175              $go_delete++;
 176          }
 177      }
 178      ?>
 179      </ul>
 180  <?php if ( $go_delete ) : ?>
 181      <fieldset><p><legend><?php echo _n( 'What should be done with posts and links owned by this user?', 'What should be done with posts and links owned by these users?', $go_delete ); ?></legend></p>
 182      <ul style="list-style:none;">
 183          <li><label><input type="radio" id="delete_option0" name="delete_option" value="delete" checked="checked" />
 184          <?php _e('Delete all posts and links.'); ?></label></li>
 185          <li><input type="radio" id="delete_option1" name="delete_option" value="reassign" />
 186          <?php echo '<label for="delete_option1">'.__('Attribute all posts and links to:').'</label>';
 187          wp_dropdown_users( array( 'name' => 'reassign_user', 'exclude' => array_diff( $userids, array($current_user->ID) ) ) ); ?></li>
 188      </ul></fieldset>
 189      <input type="hidden" name="action" value="dodelete" />
 190      <?php submit_button( __('Confirm Deletion'), 'secondary' ); ?>
 191  <?php else : ?>
 192      <p><?php _e('There are no valid users selected for deletion.'); ?></p>
 193  <?php endif; ?>
 194  </div>
 195  </form>
 196  <?php
 197  
 198  break;
 199  
 200  case 'doremove':
 201      check_admin_referer('remove-users');
 202  
 203      if ( ! is_multisite() )
 204          wp_die( __( 'You can&#8217;t remove users.' ) );
 205  
 206      if ( empty($_REQUEST['users']) ) {
 207          wp_redirect($redirect);
 208          exit;
 209      }
 210  
 211      if ( ! current_user_can( 'remove_users' ) )
 212          wp_die( __( 'You can&#8217;t remove users.' ) );
 213  
 214      $userids = $_REQUEST['users'];
 215  
 216      $update = 'remove';
 217       foreach ( $userids as $id ) {
 218          $id = (int) $id;
 219          if ( $id == $current_user->id && !is_super_admin() ) {
 220              $update = 'err_admin_remove';
 221              continue;
 222          }
 223          if ( !current_user_can('remove_user', $id) ) {
 224              $update = 'err_admin_remove';
 225              continue;
 226          }
 227          remove_user_from_blog($id, $blog_id);
 228      }
 229  
 230      $redirect = add_query_arg( array('update' => $update), $redirect);
 231      wp_redirect($redirect);
 232      exit;
 233  
 234  break;
 235  
 236  case 'remove':
 237  
 238      check_admin_referer('bulk-users');
 239  
 240      if ( ! is_multisite() )
 241          wp_die( __( 'You can&#8217;t remove users.' ) );
 242  
 243      if ( empty($_REQUEST['users']) && empty($_REQUEST['user']) ) {
 244          wp_redirect($redirect);
 245          exit();
 246      }
 247  
 248      if ( !current_user_can('remove_users') )
 249          $error = new WP_Error('edit_users', __('You can&#8217;t remove users.'));
 250  
 251      if ( empty($_REQUEST['users']) )
 252          $userids = array(intval($_REQUEST['user']));
 253      else
 254          $userids = $_REQUEST['users'];
 255  
 256      include  ('admin-header.php');
 257  ?>
 258  <form action="" method="post" name="updateusers" id="updateusers">
 259  <?php wp_nonce_field('remove-users') ?>
 260  <?php echo $referer; ?>
 261  
 262  <div class="wrap">
 263  <?php screen_icon(); ?>
 264  <h2><?php _e('Remove Users from Site'); ?></h2>
 265  <p><?php _e('You have specified these users for removal:'); ?></p>
 266  <ul>
 267  <?php
 268      $go_remove = false;
 269       foreach ( $userids as $id ) {
 270          $id = (int) $id;
 271           $user = new WP_User($id);
 272          if ( $id == $current_user->id && !is_super_admin() ) {
 273              echo "<li>" . sprintf(__('ID #%1s: %2s <strong>The current user will not be removed.</strong>'), $id, $user->user_login) . "</li>\n";
 274          } elseif ( !current_user_can('remove_user', $id) ) {
 275              echo "<li>" . sprintf(__('ID #%1s: %2s <strong>You don\'t have permission to remove this user.</strong>'), $id, $user->user_login) . "</li>\n";
 276          } else {
 277              echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />" . sprintf(__('ID #%1s: %2s'), $id, $user->user_login) . "</li>\n";
 278              $go_remove = true;
 279          }
 280       }
 281       ?>
 282  <?php if ( $go_remove ) : ?>
 283          <input type="hidden" name="action" value="doremove" />
 284          <?php submit_button( __('Confirm Removal'), 'secondary' ); ?>
 285  <?php else : ?>
 286      <p><?php _e('There are no valid users selected for removal.'); ?></p>
 287  <?php endif; ?>
 288  </div>
 289  </form>
 290  <?php
 291  
 292  break;
 293  
 294  default:
 295  
 296      if ( !empty($_GET['_wp_http_referer']) ) {
 297          wp_redirect(remove_query_arg(array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI'])));
 298          exit;
 299      }
 300  
 301      $wp_list_table->prepare_items();
 302      $total_pages = $wp_list_table->get_pagination_arg( 'total_pages' );
 303      if ( $pagenum > $total_pages && $total_pages > 0 ) {
 304          wp_redirect( add_query_arg( 'paged', $total_pages ) );
 305          exit;
 306      }
 307      include ('./admin-header.php');
 308  
 309      $messages = array();
 310      if ( isset($_GET['update']) ) :
 311          switch($_GET['update']) {
 312          case 'del':
 313          case 'del_many':
 314              $delete_count = isset($_GET['delete_count']) ? (int) $_GET['delete_count'] : 0;
 315              $messages[] = '<div id="message" class="updated"><p>' . sprintf(_n('%s user deleted', '%s users deleted', $delete_count), $delete_count) . '</p></div>';
 316              break;
 317          case 'add':
 318              $messages[] = '<div id="message" class="updated"><p>' . __('New user created.') . '</p></div>';
 319              break;
 320          case 'promote':
 321              $messages[] = '<div id="message" class="updated"><p>' . __('Changed roles.') . '</p></div>';
 322              break;
 323          case 'err_admin_role':
 324              $messages[] = '<div id="message" class="error"><p>' . __('The current user&#8217;s role must have user editing capabilities.') . '</p></div>';
 325              $messages[] = '<div id="message" class="updated"><p>' . __('Other user roles have been changed.') . '</p></div>';
 326              break;
 327          case 'err_admin_del':
 328              $messages[] = '<div id="message" class="error"><p>' . __('You can&#8217;t delete the current user.') . '</p></div>';
 329              $messages[] = '<div id="message" class="updated"><p>' . __('Other users have been deleted.') . '</p></div>';
 330              break;
 331          case 'remove':
 332              $messages[] = '<div id="message" class="updated fade"><p>' . __('User removed from this site.') . '</p></div>';
 333              break;
 334          case 'err_admin_remove':
 335              $messages[] = '<div id="message" class="error"><p>' . __("You can't remove the current user.") . '</p></div>';
 336              $messages[] = '<div id="message" class="updated fade"><p>' . __('Other users have been removed.') . '</p></div>';
 337              break;
 338          }
 339      endif; ?>
 340  
 341  <?php if ( isset($errors) && is_wp_error( $errors ) ) : ?>
 342      <div class="error">
 343          <ul>
 344          <?php
 345              foreach ( $errors->get_error_messages() as $err )
 346                  echo "<li>$err</li>\n";
 347          ?>
 348          </ul>
 349      </div>
 350  <?php endif;
 351  
 352  if ( ! empty($messages) ) {
 353      foreach ( $messages as $msg )
 354          echo $msg;
 355  } ?>
 356  
 357  <div class="wrap">
 358  <?php screen_icon(); ?>
 359  <h2>
 360  <?php
 361  echo esc_html( $title );
 362  if ( current_user_can( 'create_users' ) ) { ?>
 363      <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>
 364  <?php } elseif ( is_multisite() && current_user_can( 'promote_users' ) ) { ?>
 365      <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add Existing', 'user' ); ?></a>
 366  <?php }
 367  
 368  if ( $usersearch )
 369      printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( $usersearch ) ); ?>
 370  </h2>
 371  
 372  <?php $wp_list_table->views(); ?>
 373  
 374  <form action="" method="get">
 375  
 376  <?php $wp_list_table->search_box( __( 'Search Users' ), 'user' ); ?>
 377  
 378  <?php $wp_list_table->display(); ?>
 379  </form>
 380  
 381  <br class="clear" />
 382  </div>
 383  <?php
 384  break;
 385  
 386  } // end of the $doaction switch
 387  
 388  include ('./admin-footer.php');