WordPress.org
Get WordPress

Plugin Directory

Changeset 3407477


Ignore:
Timestamp:
12/02/2025 03:08:23 AM (12 days ago)
Author:
shinephp
Message:
  • Update: Marked as compatible with WordPress 6.9
  • Update: Minor code enhancements according to the "Plugin Check" tool recommendations.
  • Update: "Users->Grant Roles" HTML code download optimization to exclude cases when URE's "Grant Roles" data flickers or stays visible while Users page is opening.
Location:
user-role-editor/trunk
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • user-role-editor/trunk/includes/classes/ajax-processor.php

    r3208188 r3407477  
    4444        $promote_users_actions = array(
    4545            'grant_roles',
    46             'get_user_roles',
    4746            'add_role_to_user',
    4847            'revoke_role_from_user'
    … …  
    231230    // end of get_users_without_role()
    232231   
     232
     233    protected function get_grant_roles() {
     234       
     235        $answer = URE_Grant_Roles::get_dialog_html();
     236       
     237        return $answer;
     238       
     239    }
     240    // end of get_grant_roles_dialog_html()
     241   
     242
    233243   
    234244    protected function grant_roles() {
    … …  
    261271    // end of add_role_to_user()
    262272   
    263     protected function get_user_roles() {
    264        
    265         $answer = URE_Grant_Roles::get_user_roles();
    266        
    267         return $answer;
    268        
    269     }
    270     // end of get_user_roles()
    271    
    272    
     273       
    273274    protected function get_role_caps() {
    274275       
    … …  
    351352                $answer = $this->get_users_without_role();
    352353                break;
     354            case 'get_grant_roles':
     355                $answer = $this->get_grant_roles();
     356                break;
    353357            case 'grant_roles':
    354358                $answer = $this->grant_roles();
    … …  
    359363            case 'revoke_role_from_user':
    360364                $answer = $this->revoke_role_from_user();
    361                 break;
    362             case 'get_user_roles':
    363                 $answer = $this->get_user_roles();
    364365                break;
    365366            case 'get_role_caps':

  • user-role-editor/trunk/includes/classes/grant-roles.php

    r3274620 r3407477  
    329329        }
    330330               
    331         $users = $_POST['users'];       
     331        $users =  isset( $_POST['users'] ) ? $_POST['users'] : false;
    332332        if ( !self::validate_users( $users ) ) {
    333333            $answer = array('result'=>'error', 'message'=>esc_html__('Can not edit user or invalid data at the users list', 'user-role-editor') );
    … …  
    368368   
    369369   
    370     public static function get_user_roles() {
    371 
    372         if ( !current_user_can( 'promote_users' ) ) {
    373             $answer = array('result'=>'error', 'message'=>esc_html__('Not enough permissions', 'user-role-editor'));
    374             return $answer;
    375         }
    376        
    377         $lib = URE_Lib::get_instance();
    378         $user_id = (int) $lib->get_request_var('user_id', 'post', 'int');
    379         if (empty($user_id)) {
    380             $answer = array('result'=>'error', 'message'=>esc_html__('Wrong request, valid user ID was missed', 'user-role-editor'));
     370    private static function get_user_roles( $user_id ) {
     371       
     372        $answer = array('primary_role'=>'', 'other_roles'=>array() );
     373        if ( empty($user_id) ) {           
    381374            return $answer;
    382375        }
    383376   
    384377        $user = get_user_by('id', $user_id);
    385         if (empty($user)) {
    386             $answer = array('result'=>'error', 'message'=>esc_html__('Requested user does not exist', 'user-role-editor'));
     378        if ( empty( $user ) ) {
    387379            return $answer;
    388380        }
    … …  
    391383        $primary_role = array_shift($other_roles);
    392384       
    393         $answer = array('result'=>'success', 'primary_role'=>$primary_role, 'other_roles'=>$other_roles, 'message'=>'User roles were sent');
     385        $answer = array('primary_role'=>$primary_role, 'other_roles'=>$other_roles );
    394386       
    395387        return $answer;
    396388    }
    397389    // end of get_user_roles()
    398    
    399    
    400    
    401     private function select_primary_role_html() {
    402        
     390       
     391   
     392    private static function select_primary_role_html( $primary_role ) {
     393       
     394        $lib = URE_Lib::get_instance();
    403395        $select_primary_role = apply_filters('ure_users_select_primary_role', true);
    404         if (!$select_primary_role && !$this->lib->is_super_admin()) {
     396        if (!$select_primary_role && !$lib->is_super_admin()) {
    405397            return;
    406398        }
    … …  
    412404<?php           
    413405        // print the full list of roles with the primary one selected.
    414         wp_dropdown_roles('');
     406        wp_dropdown_roles( $primary_role );
    415407        echo '<option value="'. self::NO_ROLE_FOR_THIS_SITE .'">' . esc_html__('&mdash; No role for this site &mdash;', 'user-role-editor') . '</option>'. PHP_EOL;
    416408?>       
    … …  
    422414           
    423415   
    424     private function select_other_roles_html() {
     416    private static function select_other_roles_html( $other_roles ) {
     417        $lib = URE_Lib::get_instance();
    425418?>       
    426419        <div id="other_roles_container">
    … …  
    434427        $use_pll = function_exists('pll__');   
    435428       
    436         $show_admin_role = $this->lib->show_admin_role_allowed();       
    437         $roles = $this->lib->get_all_editable_roles();
     429        $show_admin_role = $lib->show_admin_role_allowed();       
     430        $roles = $lib->get_all_editable_roles();
    438431        foreach ($roles as $role_id => $role) {
    439432            if (!$show_admin_role && $role_id=='administrator') {
    440433                continue;
    441434            }
     435            $selected = ( in_array( $role_id, $other_roles ) ) ? 'checked="checked"': '';
    442436            $role_name = $use_pll ? pll__( $role['name'] ) : $role['name'];
    443437            echo '<label for="wp_role_' . $role_id . '"><input type="checkbox"  id="wp_role_' . $role_id .
    444                  '" name="ure_roles[]" value="' . $role_id . '" />&nbsp;' .
     438                 '" name="ure_roles[]" value="' . $role_id . '" '. $selected .'/>&nbsp;' .
    445439            esc_html( $role_name ) .' ('. $role_id .')</label><br />'. PHP_EOL;
    446440        }
    … …  
    451445    // end of select_other_roles_html()
    452446   
     447       
     448    public static function get_dialog_html() {
     449       
     450        if ( !current_user_can('promote_users') ) {
     451            $answer = array('result'=>'error', 'message'=>esc_html__('Not enough permissions', 'user-role-editor'));
     452            return $answer;
     453        }
     454       
     455        $lib = URE_Lib::get_instance();
     456        $user_id = $lib->get_request_var('user_id', 'post', 'int');
     457        $data = self::get_user_roles( $user_id );
     458        ob_start();
     459        self::select_primary_role_html( $data['primary_role'] );
     460        self::select_other_roles_html( $data['other_roles'] );
     461        $output = ob_get_clean();
     462        $answer = array('result'=>'success', 'message'=>'Grant roles dialog HTML', 'html'=>$output );
     463       
     464        return $answer;
     465    }
     466    // end of get_dialog_html()
     467
    453468   
    454469    private function get_roles_options_list() {
    … …  
    461476    }
    462477    // end of get_roles_options_list()
    463    
    464    
    465     public function show_roles_manage_html() {
     478
     479       
     480    public function show_roles_manage_html( $which ) {
    466481                     
    467482        if ( !current_user_can( 'promote_users' ) ) {
    468483            return;
    469484        }
    470         $button_number =  (self::$counter>0) ? '_2': '';
     485        $button_number =  ( $which==='bottom') ? '_2': '';
     486        // escaped for secure output already
    471487        $roles_options_list = self::get_roles_options_list();
     488        ob_start();
    472489?>       
    473490        &nbsp;&nbsp;
    … …  
    493510       
    494511<?php
    495     if (self::$counter==0) {
     512        if ( $which==='bottom' ) {
    496513?>
    497514            <div id="ure_grant_roles_dialog" class="ure-dialog">
    498                 <div id="ure_grant_roles_content">
    499 <?php               
    500                 $this->select_primary_role_html();
    501                 $this->select_other_roles_html();
    502 ?>               
    503                 </div>
     515                <div id="ure_grant_roles_container"></div>
    504516            </div>
    505517<?php
    506         URE_View::output_task_status_div();
    507         self::$counter++;
    508     }
    509        
     518         URE_View::output_task_status_div();
     519        }
     520        $output = ob_get_clean();
     521        echo $output;
    510522    }
    511523    // end of show_grant_roles_html()

  • user-role-editor/trunk/includes/classes/settings.php

    r2715703 r3407477  
    2020            'ure_default_roles_update',
    2121            'ure_settings_tools_exec');
    22         foreach($update_buttons as $update_button) {
    23             if (!isset($_POST[$update_button])) {
     22        foreach( $update_buttons as $update_button ) {
     23            if ( !isset( $_POST[$update_button] ) ) {
    2424                continue;
    2525            }
    26             if (!wp_verify_nonce($_POST['_wpnonce'], 'user-role-editor')) {
     26            if ( !wp_verify_nonce($_POST['_wpnonce'], 'user-role-editor') ) {
    2727                wp_die('Security check failed');
    2828            }
    … …  
    203203            echo '<label for="wp_role_' . $role_id .'"><input type="checkbox"   id="wp_role_' . $role_id .
    204204                '" name="wp_role_' . $role_id . '" value="' . $role_id . '"' . $checked .' />&nbsp;' .
    205                 $role['name'] . '</label><br />';
     205                esc_html( $role['name'] ) . '</label><br />';
    206206          }     
    207207           

  • user-role-editor/trunk/includes/classes/tools.php

    r2649770 r3407477  
    4242            <input type="hidden" name="ure_settings_tools_exec" value="1" />
    4343            <input type="hidden" name="ure_reset_roles_exec" value="1" />
    44             <input type="hidden" name="ure_tab_idx" value="<?php echo $tab_idx; ?>" />
     44            <input type="hidden" name="ure_tab_idx" value="<?php echo (int) $tab_idx; ?>" />
    4545        </form>               
    4646    </div>   

  • user-role-editor/trunk/includes/classes/user-view.php

    r3201795 r3407477  
    6363            $anchor_end = '';
    6464        }
    65         $user_info = ' <span style="font-weight: bold;">' . $anchor_start . $this->user_to_edit->user_login;
     65        $user_info = ' <span style="font-weight: bold;">' . $anchor_start . esc_html( $this->user_to_edit->user_login );
    6666        if ($this->user_to_edit->display_name !== $this->user_to_edit->user_login) {
    67             $user_info .= ' (' . $this->user_to_edit->display_name . ')';
     67            $user_info .= ' ('. esc_html( $this->user_to_edit->display_name ) .')';
    6868        }
    6969        $user_info .= $anchor_end . '</span>';
    … …  
    189189        $bbp_user_role = bbp_get_user_role($this->user_to_edit->ID);
    190190        if (!empty($bbp_user_role)) {
    191             echo $dynamic_roles[$bbp_user_role]['name'];
     191            echo esc_html( $dynamic_roles[$bbp_user_role]['name'] );
    192192        }
    193193    }

  • user-role-editor/trunk/includes/settings-template.php

    r2878948 r3407477  
    5050    <div id="ure_tabs-1">
    5151    <div id="ure-settings-form">
    52         <form method="post" action="<?php echo $link; ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >   
     52        <form method="post" action="<?php echo esc_url( $link ); ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >   
    5353            <table id="ure_settings">
    5454<?php
    … …  
    131131   
    132132    <div id="ure_tabs-2">
    133         <form name="ure_additional_modules" method="post" action="<?php echo $link; ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >
     133        <form name="ure_additional_modules" method="post" action="<?php echo esc_url( $link ); ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >
    134134            <table id="ure_addons">
    135135<?php
    … …  
    163163   
    164164    <div id="ure_tabs-3">
    165         <form name="ure_default_roles" method="post" action="<?php echo $link; ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >
     165        <form name="ure_default_roles" method="post" action="<?php echo esc_url( $link ); ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >
    166166<?php
    167167    if ( ! $multisite ) {
    168168        esc_html_e( 'Primary default role: ', 'user-role-editor' );
     169        // User input is not used - ignore Plugin Check warning
    169170        echo $view->role_default_html;
    170171?>
    … …  
    184185        <hr>
    185186        <?php wp_nonce_field( 'user-role-editor' ); ?>
    186             <input type="hidden" name="ure_tab_idx" value="<?php echo $tabs_index[3]; ?>" />
     187            <input type="hidden" name="ure_tab_idx" value="<?php echo (int) $tabs_index[3]; ?>" />
    187188            <p class="submit">
    188189                <input type="submit" class="button-primary" name="ure_default_roles_update" value="<?php esc_html_e( 'Save', 'user-role-editor' ) ?>" />
    … …  
    196197    <div id="ure_tabs-4">
    197198        <div id="ure-settings-form-ms">
    198             <form name="ure_settings_ms" method="post" action="<?php echo $link; ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >
     199            <form name="ure_settings_ms" method="post" action="<?php echo esc_url( $link ); ?>?page=settings-<?php echo URE_PLUGIN_FILE; ?>" >
    199200                <table id="ure_settings_ms">
    200201<?php
    … …  
    216217                </table>
    217218<?php wp_nonce_field( 'user-role-editor' ); ?>   
    218                 <input type="hidden" name="ure_tab_idx" value="<?php echo $tabs_index[4]; ?>" />
     219                <input type="hidden" name="ure_tab_idx" value="<?php echo (int) $tabs_index[4]; ?>" />
    219220            <p class="submit">
    220221                <input type="submit" class="button-primary" name="ure_settings_ms_update" value="<?php esc_html_e( 'Save', 'user-role-editor' ); ?>" />
    … …  
    251252    if ($ure_tab_idx>0 && $ure_tab_idx<=count($tabs_index)) {
    252253?>
    253         $('#ure_tabs').tabs('option', 'active', <?php echo $ure_tab_idx; ?>);
     254        $('#ure_tabs').tabs('option', 'active', <?php echo (int) $ure_tab_idx; ?>);
    254255<?php
    255256    }

  • user-role-editor/trunk/js/users-grant-roles.js

    r3208188 r3407477  
    4141
    4242
    43 function ure_show_grant_roles_dialog_pre_selected(response) {
    44     jQuery('#ure_task_status').hide();
    45     if (response!==null && response.result=='error') {
    46         alert(response.message);
    47         return;
    48     }
    49     if (response.primary_role!==null && response.primary_role.length>0 && jQuery('#primary_role').length>0) {
    50         jQuery('#primary_role').val(response.primary_role);
    51     }
    52    
    53     if (response.other_roles!==null && response.other_roles.length>0) {
    54         for(i=0;i<response.other_roles.length;i++) {
    55             jQuery('#wp_role_'+ response.other_roles[i]).prop('checked', true);
    56         }
    57     }
    58    
    59     ure_show_grant_roles_dialog();
    60    
    61 }
    62 
    63 
    64 function ure_get_selected_user_roles(users) {
     43function ure_grant_roles() { 
     44   
     45    var primary_role = jQuery('#primary_role').val();
     46    var other_roles = ure_get_selected_checkboxes('ure_roles');
    6547    jQuery('#ure_task_status').show();
    66     var user_id = users.shift();
     48    var users = ure_get_selected_checkboxes('users');
    6749    var data = {
    6850        'action': 'ure_ajax',
    69         'sub_action':'get_user_roles',
    70         'user_id': user_id,
    71         'wp_nonce': ure_users_grant_roles_data.wp_nonce};
    72     jQuery.post(ajaxurl, data, ure_show_grant_roles_dialog_pre_selected, 'json');
    73 }
    74 
    75 
    76 function ure_unselect_roles() {
    77     jQuery('#primary_role').val([]);
    78    
    79     // uncheck all checked checkboxes if there are any
    80     jQuery('input[type="checkbox"][name="ure_roles\\[\\]"]:checked').map(function() {
    81         this.checked = false;
    82     });
    83 }
    84 
    85 function ure_prepare_grant_roles_dialog() {
    86     var users = ure_get_selected_checkboxes('users');
    87     if (users.length==0) {
    88         alert(ure_users_grant_roles_data.select_users_first);
    89         return;
    90     }
    91    
    92     if (users.length==1) {
    93         ure_get_selected_user_roles(users);
    94     } else {
    95         ure_unselect_roles();       
    96         ure_show_grant_roles_dialog();
    97     }
    98    
    99 }
    100 
    101 
    102 function ure_show_grant_roles_dialog() {
     51        'sub_action':'grant_roles',
     52        'users': users,
     53        'primary_role': primary_role,
     54        'other_roles': other_roles,
     55        'wp_nonce': ure_users_grant_roles_data.wp_nonce
     56    };
     57    jQuery.post(ajaxurl, data, ure_page_reload, 'json');
     58   
     59    return true;
     60}
     61
     62
     63function ure_show_grant_roles_dialog( data ) {
    10364   
    10465    jQuery('#ure_grant_roles_dialog').dialog({
    … …  
    11677                jQuery(this).dialog('close');
    11778                return true;
    118             },
     79                },
    11980            Cancel: function () {
    12081                jQuery(this).dialog('close');
    12182                return false;
     83                }
    12284            }
    123         }
    124     });
    125 }
    126 
    127 
    128 function ure_grant_roles() {   
    129     var primary_role = jQuery('#primary_role').val();
    130     var other_roles = ure_get_selected_checkboxes('ure_roles');
    131     jQuery('#ure_task_status').show();
    132     var users = ure_get_selected_checkboxes('users');
    133     var data = {
    134         'action': 'ure_ajax',
    135         'sub_action':'grant_roles',
    136         'users': users,
    137         'primary_role': primary_role,
    138         'other_roles': other_roles,
    139         'wp_nonce': ure_users_grant_roles_data.wp_nonce
    140     };
    141     jQuery.post(ajaxurl, data, ure_page_reload, 'json');
    142    
    143     return true;
     85        });
     86    jQuery('#ure_grant_roles_container').html( data.html );
     87
     88}
     89
     90
     91function ure_get_user_roles_markup( user_id ) {
     92    jQuery.ajax({
     93        url: ajaxurl,
     94        type: 'POST',
     95        dataType: 'html',
     96        data: {
     97            action: 'ure_ajax',
     98            sub_action: 'get_grant_roles',
     99            user_id : user_id,
     100            wp_nonce: ure_users_grant_roles_data.wp_nonce
     101        },
     102        success: function(response) {
     103            var data = jQuery.parseJSON( response );
     104            if (typeof data.result !== 'undefined') {
     105                if (data.result === 'success') {                   
     106                    ure_show_grant_roles_dialog( data );
     107                } else if (data.result === 'failure') {
     108                    alert(data.message);
     109                } else {
     110                    alert('Wrong response: ' + response)
     111                }
     112            } else {
     113                alert('Wrong response: ' + response)
     114            }
     115        },
     116        error: function(XMLHttpRequest, textStatus, exception) {
     117            alert("Ajax failure\n" + XMLHttpRequest.statusText);
     118        },
     119        async: true
     120    });   
     121}
     122
     123
     124function ure_prepare_grant_roles_dialog() {
     125    var users = ure_get_selected_checkboxes('users');
     126    if ( users.length===0 ) {
     127        alert(ure_users_grant_roles_data.select_users_first);
     128        return;
     129    }
     130    var user_id = ( users.length===1) ? users[0] : 0;
     131    ure_get_user_roles_markup( user_id );
    144132}
    145133

  • user-role-editor/trunk/readme.txt

    r3274692 r3407477  
    33Tags: user, role, editor, security, access
    44Requires at least: 4.4
    5 Tested up to: 6.8
     5Tested up to: 6.9
    66Stable tag: 4.64.5
    77Requires PHP: 7.3
    … …  
    8282
    8383== Changelog =
     84
     85= [4.64.6] 01.12.2025 =
     86* Update: Marked as compatible with WordPress 6.9
     87* Update: Minor code enhancements according to the "Plugin Check" tool recommendations.
     88* Update: "Users->Grant Roles" HTML code download optimization to exclude cases when URE's "Grant Roles" data flickers or stays visible while Users page is opening.
     89
    8490= [4.64.5] 16.04.2025 =
    8591* Update: Marked as compatible with WordPress 6.8
    8692* Update: Minor changes were applied to the CSS/JS loading code to minimize "Plugin Check" tool warnings.
    8793* Plugin headers were extended at role-editor.php and readme.txt files according to wordpress.org recommendations.
    88 
    89 = [4.64.4] 15.12.2024 =
    90 * Security Fix: Users - "Add Role", "Revoke Role" buttons: Cross-Site request forgery to privilege escalation was possible due to missed nonce validation. This issue was discovered and responsibly reported by vgo0.
    9194
    9295File changelog.txt contains the full list of changes.
    … …  
    100103== Upgrade Notice ==
    101104
    102 = [4.64.5] 16.04.2025 =
    103 * Update: Marked as compatible with WordPress 6.8
    104 * Update: Minor changes were applied to the CSS/JS loading code to minimize "Plugin Check" tool warnings.
     105= [4.64.6] 01.12.2025 =
     106* Update: Marked as compatible with WordPress 6.9
     107* Update: Minor code enhancements according to the "Plugin Check" tool recommendations.
     108* Update: "Users->Grant Roles" HTML code download optimization to exclude cases when URE's "Grant Roles" data flickers or stays visible while Users page is opening.

  • user-role-editor/trunk/user-role-editor.php

    r3274620 r3407477  
    44Plugin URI:         https://www.role-editor.com
    55Description:        Change/add/delete WordPress user roles and capabilities.
    6 Version:            4.64.5
     6Version:            4.64.6
    77Requires at least:  4.4
    88Requires PHP:       7.3
    … …  
    3434}
    3535
    36 define( 'URE_VERSION', '4.64.5' );
     36define( 'URE_VERSION', '4.64.6' );
    3737define( 'URE_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
    3838define( 'URE_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
Note: See TracChangeset for help on using the changeset viewer.