vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 20:30:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add some CYA cap checks.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@11761 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren
2009-08-01 21:12:17 +00:00
parent ebd60f5a91
commit 98b8d02a40
11 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-admin/plugins.php
+18
View File
@@ -9,6 +9,9 @@
/** WordPress Administration Bootstrap */
require_once('admin.php');
if ( ! current_user_can('activate_plugins') )
wp_die(__('You do not have sufficient permissions to manage plugins for this blog.'));
if ( isset($_POST['clear-recent-list']) )
$action = 'clear-recent-list';
elseif ( !empty($_REQUEST['action']) )
@@ -37,6 +40,9 @@ $_SERVER['REQUEST_URI'] = remove_query_arg(array('error', 'deleted', 'activate',
if ( !empty($action) ) {
switch ( $action ) {
case 'activate':
if ( ! current_user_can('activate_plugins') )
wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
check_admin_referer('activate-plugin_' . $plugin);
$result = activate_plugin($plugin, 'plugins.php?error=true&plugin=' . $plugin);
@@ -53,6 +59,9 @@ if ( !empty($action) ) {
exit;
break;
case 'activate-selected':
if ( ! current_user_can('activate_plugins') )
wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
check_admin_referer('bulk-manage-plugins');
$plugins = (array) $_POST['checked'];
@@ -75,6 +84,9 @@ if ( !empty($action) ) {
exit;
break;
case 'error_scrape':
if ( ! current_user_can('activate_plugins') )
wp_die(__('You do not have sufficient permissions to activate plugins for this blog.'));
check_admin_referer('plugin-activation-error_' . $plugin);
$valid = validate_plugin($plugin);
@@ -88,6 +100,9 @@ if ( !empty($action) ) {
exit;
break;
case 'deactivate':
if ( ! current_user_can('activate_plugins') )
wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
check_admin_referer('deactivate-plugin_' . $plugin);
deactivate_plugins($plugin);
update_option('recently_activated', array($plugin => time()) + (array)get_option('recently_activated'));
@@ -95,6 +110,9 @@ if ( !empty($action) ) {
exit;
break;
case 'deactivate-selected':
if ( ! current_user_can('activate_plugins') )
wp_die(__('You do not have sufficient permissions to deactivate plugins for this blog.'));
check_admin_referer('bulk-manage-plugins');
$plugins = (array) $_POST['checked'];