Options, Meta APIs: Require a confirmation link in an email to be clicked when a user attempts to change the network

admin email address on Multisite.

This mirrors the same functionality for the site admin email address and user profile email address.

Fixes #41254


git-svn-id: https://develop.svn.wordpress.org/trunk@41617 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
John Blackbourn
2017-09-27 14:16:21 +00:00
parent 9d23f61503
commit 301ecdabe4
3 changed files with 123 additions and 3 deletions

View File

@@ -19,6 +19,26 @@ if ( ! current_user_can( 'manage_network_options' ) )
$title = __( 'Network Settings' );
$parent_file = 'settings.php';
// Handle network admin email change requests
if ( ! empty( $_GET[ 'network_admin_hash' ] ) ) {
$new_admin_details = get_site_option( 'network_admin_hash' );
$redirect = 'settings.php?updated=false';
if ( is_array( $new_admin_details ) && hash_equals( $new_admin_details[ 'hash' ], $_GET[ 'network_admin_hash' ] ) && ! empty( $new_admin_details[ 'newemail' ] ) ) {
update_site_option( 'admin_email', $new_admin_details[ 'newemail' ] );
delete_site_option( 'network_admin_hash' );
delete_site_option( 'new_admin_email' );
$redirect = 'settings.php?updated=true';
}
wp_redirect( network_admin_url( $redirect ) );
exit;
} elseif ( ! empty( $_GET['dismiss'] ) && 'new_network_admin_email' == $_GET['dismiss'] ) {
check_admin_referer( 'dismiss_new_network_admin_email' );
delete_site_option( 'network_admin_hash' );
delete_site_option( 'new_admin_email' );
wp_redirect( network_admin_url( 'settings.php?updated=true' ) );
exit;
}
add_action( 'admin_head', 'network_settings_add_js' );
get_current_screen()->add_help_tab( array(
@@ -58,7 +78,7 @@ if ( $_POST ) {
'upload_space_check_disabled', 'blog_upload_space', 'upload_filetypes', 'site_name',
'first_post', 'first_page', 'first_comment', 'first_comment_url', 'first_comment_author',
'welcome_email', 'welcome_user_email', 'fileupload_maxk', 'global_terms_enabled',
'illegal_names', 'limited_email_domains', 'banned_email_domains', 'WPLANG', 'admin_email',
'illegal_names', 'limited_email_domains', 'banned_email_domains', 'WPLANG', 'new_admin_email',
'first_comment_email',
);
@@ -111,10 +131,28 @@ if ( isset( $_GET['updated'] ) ) {
<tr>
<th scope="row"><label for="admin_email"><?php _e( 'Network Admin Email' ) ?></label></th>
<td>
<input name="admin_email" type="email" id="admin_email" aria-describedby="admin-email-desc" class="regular-text" value="<?php echo esc_attr( get_site_option( 'admin_email' ) ) ?>" />
<input name="new_admin_email" type="email" id="admin_email" aria-describedby="admin-email-desc" class="regular-text" value="<?php echo esc_attr( get_site_option( 'admin_email' ) ) ?>" />
<p class="description" id="admin-email-desc">
<?php _e( 'This email address will receive notifications. Registration and support emails will also come from this address.' ); ?>
<?php _e( 'This address is used for admin purposes. If you change this we will send you an email at your new address to confirm it. <strong>The new address will not become active until confirmed.</strong>' ); ?>
</p>
<?php
$new_admin_email = get_site_option( 'new_admin_email' );
if ( $new_admin_email && $new_admin_email != get_site_option( 'admin_email' ) ) : ?>
<div class="updated inline">
<p><?php
printf(
/* translators: %s: new network admin email */
__( 'There is a pending change of the network admin email to %s.' ),
'<code>' . esc_html( $new_admin_email ) . '</code>'
);
printf(
' <a href="%1$s">%2$s</a>',
esc_url( wp_nonce_url( network_admin_url( 'settings.php?dismiss=new_network_admin_email' ), 'dismiss_new_network_admin_email' ) ),
__( 'Cancel' )
);
?></p>
</div>
<?php endif; ?>
</td>
</tr>
</table>