[ Index ] |
PHP Cross Reference of WordPress |
[Summary view] [Print] [Text view]
1 <?php 2 /** 3 * User administration panel 4 * 5 * @package WordPress 6 * @subpackage Administration 7 * @since 1.0.0 8 */ 9 10 /** WordPress Administration Bootstrap */ 11 require_once __DIR__ . '/admin.php'; 12 13 if ( ! current_user_can( 'list_users' ) ) { 14 wp_die( 15 '<h1>' . __( 'You need a higher level of permission.' ) . '</h1>' . 16 '<p>' . __( 'Sorry, you are not allowed to list users.' ) . '</p>', 17 403 18 ); 19 } 20 21 $wp_list_table = _get_list_table( 'WP_Users_List_Table' ); 22 $pagenum = $wp_list_table->get_pagenum(); 23 $title = __( 'Users' ); 24 $parent_file = 'users.php'; 25 26 add_screen_option( 'per_page' ); 27 28 // Contextual help - choose Help on the top right of admin panel to preview this. 29 get_current_screen()->add_help_tab( 30 array( 31 'id' => 'overview', 32 'title' => __( 'Overview' ), 33 'content' => '<p>' . __( 'This screen lists all the existing users for your site. Each user has one of five defined roles as set by the site admin: Site Administrator, Editor, Author, Contributor, or Subscriber. Users with roles other than Administrator will see fewer options in the dashboard navigation when they are logged in, based on their role.' ) . '</p>' . 34 '<p>' . __( 'To add a new user for your site, click the Add New button at the top of the screen or Add New in the Users menu section.' ) . '</p>', 35 ) 36 ); 37 38 get_current_screen()->add_help_tab( 39 array( 40 'id' => 'screen-content', 41 'title' => __( 'Screen Content' ), 42 'content' => '<p>' . __( 'You can customize the display of this screen in a number of ways:' ) . '</p>' . 43 '<ul>' . 44 '<li>' . __( 'You can hide/display columns based on your needs and decide how many users to list per screen using the Screen Options tab.' ) . '</li>' . 45 '<li>' . __( 'You can filter the list of users by User Role using the text links above the users list to show All, Administrator, Editor, Author, Contributor, or Subscriber. The default view is to show all users. Unused User Roles are not listed.' ) . '</li>' . 46 '<li>' . __( 'You can view all posts made by a user by clicking on the number under the Posts column.' ) . '</li>' . 47 '</ul>', 48 ) 49 ); 50 51 $help = '<p>' . __( 'Hovering over a row in the users list will display action links that allow you to manage users. You can perform the following actions:' ) . '</p>' . 52 '<ul>' . 53 '<li>' . __( '<strong>Edit</strong> takes you to the editable profile screen for that user. You can also reach that screen by clicking on the username.' ) . '</li>'; 54 55 if ( is_multisite() ) { 56 $help .= '<li>' . __( '<strong>Remove</strong> allows you to remove a user from your site. It does not delete their content. You can also remove multiple users at once by using bulk actions.' ) . '</li>'; 57 } else { 58 $help .= '<li>' . __( '<strong>Delete</strong> brings you to the Delete Users screen for confirmation, where you can permanently remove a user from your site and delete their content. You can also delete multiple users at once by using bulk actions.' ) . '</li>'; 59 } 60 61 $help .= '</ul>'; 62 63 get_current_screen()->add_help_tab( 64 array( 65 'id' => 'action-links', 66 'title' => __( 'Available Actions' ), 67 'content' => $help, 68 ) 69 ); 70 unset( $help ); 71 72 get_current_screen()->set_help_sidebar( 73 '<p><strong>' . __( 'For more information:' ) . '</strong></p>' . 74 '<p>' . __( '<a href="https://wordpress.org/support/article/users-screen/">Documentation on Managing Users</a>' ) . '</p>' . 75 '<p>' . __( '<a href="https://wordpress.org/support/article/roles-and-capabilities/">Descriptions of Roles and Capabilities</a>' ) . '</p>' . 76 '<p>' . __( '<a href="https://wordpress.org/support/">Support</a>' ) . '</p>' 77 ); 78 79 get_current_screen()->set_screen_reader_content( 80 array( 81 'heading_views' => __( 'Filter users list' ), 82 'heading_pagination' => __( 'Users list navigation' ), 83 'heading_list' => __( 'Users list' ), 84 ) 85 ); 86 87 if ( empty( $_REQUEST ) ) { 88 $referer = '<input type="hidden" name="wp_http_referer" value="' . esc_attr( wp_unslash( $_SERVER['REQUEST_URI'] ) ) . '" />'; 89 } elseif ( isset( $_REQUEST['wp_http_referer'] ) ) { 90 $redirect = remove_query_arg( array( 'wp_http_referer', 'updated', 'delete_count' ), wp_unslash( $_REQUEST['wp_http_referer'] ) ); 91 $referer = '<input type="hidden" name="wp_http_referer" value="' . esc_attr( $redirect ) . '" />'; 92 } else { 93 $redirect = 'users.php'; 94 $referer = ''; 95 } 96 97 $update = ''; 98 99 switch ( $wp_list_table->current_action() ) { 100 101 /* Bulk Dropdown menu Role changes */ 102 case 'promote': 103 check_admin_referer( 'bulk-users' ); 104 105 if ( ! current_user_can( 'promote_users' ) ) { 106 wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 ); 107 } 108 109 if ( empty( $_REQUEST['users'] ) ) { 110 wp_redirect( $redirect ); 111 exit; 112 } 113 114 $editable_roles = get_editable_roles(); 115 $role = $_REQUEST['new_role']; 116 117 if ( ! $role || empty( $editable_roles[ $role ] ) ) { 118 wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 ); 119 } 120 121 $userids = $_REQUEST['users']; 122 $update = 'promote'; 123 foreach ( $userids as $id ) { 124 $id = (int) $id; 125 126 if ( ! current_user_can( 'promote_user', $id ) ) { 127 wp_die( __( 'Sorry, you are not allowed to edit this user.' ), 403 ); 128 } 129 130 // The new role of the current user must also have the promote_users cap or be a multisite super admin. 131 if ( $id == $current_user->ID && ! $wp_roles->role_objects[ $role ]->has_cap( 'promote_users' ) 132 && ! ( is_multisite() && current_user_can( 'manage_network_users' ) ) ) { 133 $update = 'err_admin_role'; 134 continue; 135 } 136 137 // If the user doesn't already belong to the blog, bail. 138 if ( is_multisite() && ! is_user_member_of_blog( $id ) ) { 139 wp_die( 140 '<h1>' . __( 'Something went wrong.' ) . '</h1>' . 141 '<p>' . __( 'One of the selected users is not a member of this site.' ) . '</p>', 142 403 143 ); 144 } 145 146 $user = get_userdata( $id ); 147 $user->set_role( $role ); 148 } 149 150 wp_redirect( add_query_arg( 'update', $update, $redirect ) ); 151 exit; 152 153 case 'dodelete': 154 if ( is_multisite() ) { 155 wp_die( __( 'User deletion is not allowed from this screen.' ), 400 ); 156 } 157 158 check_admin_referer( 'delete-users' ); 159 160 if ( empty( $_REQUEST['users'] ) ) { 161 wp_redirect( $redirect ); 162 exit; 163 } 164 165 $userids = array_map( 'intval', (array) $_REQUEST['users'] ); 166 167 if ( empty( $_REQUEST['delete_option'] ) ) { 168 $url = self_admin_url( 'users.php?action=delete&users[]=' . implode( '&users[]=', $userids ) . '&error=true' ); 169 $url = str_replace( '&', '&', wp_nonce_url( $url, 'bulk-users' ) ); 170 wp_redirect( $url ); 171 exit; 172 } 173 174 if ( ! current_user_can( 'delete_users' ) ) { 175 wp_die( __( 'Sorry, you are not allowed to delete users.' ), 403 ); 176 } 177 178 $update = 'del'; 179 $delete_count = 0; 180 181 foreach ( $userids as $id ) { 182 if ( ! current_user_can( 'delete_user', $id ) ) { 183 wp_die( __( 'Sorry, you are not allowed to delete that user.' ), 403 ); 184 } 185 186 if ( $id == $current_user->ID ) { 187 $update = 'err_admin_del'; 188 continue; 189 } 190 switch ( $_REQUEST['delete_option'] ) { 191 case 'delete': 192 wp_delete_user( $id ); 193 break; 194 case 'reassign': 195 wp_delete_user( $id, $_REQUEST['reassign_user'] ); 196 break; 197 } 198 ++$delete_count; 199 } 200 201 $redirect = add_query_arg( 202 array( 203 'delete_count' => $delete_count, 204 'update' => $update, 205 ), 206 $redirect 207 ); 208 wp_redirect( $redirect ); 209 exit; 210 211 case 'delete': 212 if ( is_multisite() ) { 213 wp_die( __( 'User deletion is not allowed from this screen.' ), 400 ); 214 } 215 216 check_admin_referer( 'bulk-users' ); 217 218 if ( empty( $_REQUEST['users'] ) && empty( $_REQUEST['user'] ) ) { 219 wp_redirect( $redirect ); 220 exit; 221 } 222 223 if ( ! current_user_can( 'delete_users' ) ) { 224 $errors = new WP_Error( 'edit_users', __( 'Sorry, you are not allowed to delete users.' ) ); 225 } 226 227 if ( empty( $_REQUEST['users'] ) ) { 228 $userids = array( (int) $_REQUEST['user'] ); 229 } else { 230 $userids = array_map( 'intval', (array) $_REQUEST['users'] ); 231 } 232 233 $all_userids = $userids; 234 235 if ( in_array( $current_user->ID, $userids, true ) ) { 236 $userids = array_diff( $userids, array( $current_user->ID ) ); 237 } 238 239 /** 240 * Filters whether the users being deleted have additional content 241 * associated with them outside of the `post_author` and `link_owner` relationships. 242 * 243 * @since 5.2.0 244 * 245 * @param bool $users_have_additional_content Whether the users have additional content. Default false. 246 * @param int[] $userids Array of IDs for users being deleted. 247 */ 248 $users_have_content = (bool) apply_filters( 'users_have_additional_content', false, $userids ); 249 250 if ( $userids && ! $users_have_content ) { 251 if ( $wpdb->get_var( "SELECT ID FROM {$wpdb->posts} WHERE post_author IN( " . implode( ',', $userids ) . ' ) LIMIT 1' ) ) { 252 $users_have_content = true; 253 } elseif ( $wpdb->get_var( "SELECT link_id FROM {$wpdb->links} WHERE link_owner IN( " . implode( ',', $userids ) . ' ) LIMIT 1' ) ) { 254 $users_have_content = true; 255 } 256 } 257 258 if ( $users_have_content ) { 259 add_action( 'admin_head', 'delete_users_add_js' ); 260 } 261 262 require_once ABSPATH . 'wp-admin/admin-header.php'; 263 ?> 264 <form method="post" name="updateusers" id="updateusers"> 265 <?php wp_nonce_field( 'delete-users' ); ?> 266 <?php echo $referer; ?> 267 268 <div class="wrap"> 269 <h1><?php _e( 'Delete Users' ); ?></h1> 270 <?php if ( isset( $_REQUEST['error'] ) ) : ?> 271 <div class="error"> 272 <p><strong><?php _e( 'Error:' ); ?></strong> <?php _e( 'Please select an option.' ); ?></p> 273 </div> 274 <?php endif; ?> 275 276 <?php if ( 1 === count( $all_userids ) ) : ?> 277 <p><?php _e( 'You have specified this user for deletion:' ); ?></p> 278 <?php else : ?> 279 <p><?php _e( 'You have specified these users for deletion:' ); ?></p> 280 <?php endif; ?> 281 282 <ul> 283 <?php 284 $go_delete = 0; 285 foreach ( $all_userids as $id ) { 286 $user = get_userdata( $id ); 287 if ( $id == $current_user->ID ) { 288 /* translators: 1: User ID, 2: User login. */ 289 echo '<li>' . sprintf( __( 'ID #%1$s: %2$s <strong>The current user will not be deleted.</strong>' ), $id, $user->user_login ) . "</li>\n"; 290 } else { 291 /* translators: 1: User ID, 2: User login. */ 292 echo '<li><input type="hidden" name="users[]" value="' . esc_attr( $id ) . '" />' . sprintf( __( 'ID #%1$s: %2$s' ), $id, $user->user_login ) . "</li>\n"; 293 $go_delete++; 294 } 295 } 296 ?> 297 </ul> 298 <?php 299 if ( $go_delete ) : 300 301 if ( ! $users_have_content ) : 302 ?> 303 <input type="hidden" name="delete_option" value="delete" /> 304 <?php else : ?> 305 <?php if ( 1 == $go_delete ) : ?> 306 <fieldset><p><legend><?php _e( 'What should be done with content owned by this user?' ); ?></legend></p> 307 <?php else : ?> 308 <fieldset><p><legend><?php _e( 'What should be done with content owned by these users?' ); ?></legend></p> 309 <?php endif; ?> 310 <ul style="list-style:none;"> 311 <li><label><input type="radio" id="delete_option0" name="delete_option" value="delete" /> 312 <?php _e( 'Delete all content.' ); ?></label></li> 313 <li><input type="radio" id="delete_option1" name="delete_option" value="reassign" /> 314 <?php 315 echo '<label for="delete_option1">' . __( 'Attribute all content to:' ) . '</label> '; 316 wp_dropdown_users( 317 array( 318 'name' => 'reassign_user', 319 'exclude' => $userids, 320 'show' => 'display_name_with_login', 321 ) 322 ); 323 ?> 324 </li> 325 </ul></fieldset> 326 <?php 327 endif; 328 /** 329 * Fires at the end of the delete users form prior to the confirm button. 330 * 331 * @since 4.0.0 332 * @since 4.5.0 The `$userids` parameter was added. 333 * 334 * @param WP_User $current_user WP_User object for the current user. 335 * @param int[] $userids Array of IDs for users being deleted. 336 */ 337 do_action( 'delete_user_form', $current_user, $userids ); 338 ?> 339 <input type="hidden" name="action" value="dodelete" /> 340 <?php submit_button( __( 'Confirm Deletion' ), 'primary' ); ?> 341 <?php else : ?> 342 <p><?php _e( 'There are no valid users selected for deletion.' ); ?></p> 343 <?php endif; ?> 344 </div> 345 </form> 346 <?php 347 348 break; 349 350 case 'doremove': 351 check_admin_referer( 'remove-users' ); 352 353 if ( ! is_multisite() ) { 354 wp_die( __( 'You can’t remove users.' ), 400 ); 355 } 356 357 if ( empty( $_REQUEST['users'] ) ) { 358 wp_redirect( $redirect ); 359 exit; 360 } 361 362 if ( ! current_user_can( 'remove_users' ) ) { 363 wp_die( __( 'Sorry, you are not allowed to remove users.' ), 403 ); 364 } 365 366 $userids = $_REQUEST['users']; 367 368 $update = 'remove'; 369 foreach ( $userids as $id ) { 370 $id = (int) $id; 371 if ( ! current_user_can( 'remove_user', $id ) ) { 372 $update = 'err_admin_remove'; 373 continue; 374 } 375 remove_user_from_blog( $id, $blog_id ); 376 } 377 378 $redirect = add_query_arg( array( 'update' => $update ), $redirect ); 379 wp_redirect( $redirect ); 380 exit; 381 382 case 'remove': 383 check_admin_referer( 'bulk-users' ); 384 385 if ( ! is_multisite() ) { 386 wp_die( __( 'You can’t remove users.' ), 400 ); 387 } 388 389 if ( empty( $_REQUEST['users'] ) && empty( $_REQUEST['user'] ) ) { 390 wp_redirect( $redirect ); 391 exit; 392 } 393 394 if ( ! current_user_can( 'remove_users' ) ) { 395 $error = new WP_Error( 'edit_users', __( 'Sorry, you are not allowed to remove users.' ) ); 396 } 397 398 if ( empty( $_REQUEST['users'] ) ) { 399 $userids = array( (int) $_REQUEST['user'] ); 400 } else { 401 $userids = $_REQUEST['users']; 402 } 403 404 require_once ABSPATH . 'wp-admin/admin-header.php'; 405 ?> 406 <form method="post" name="updateusers" id="updateusers"> 407 <?php wp_nonce_field( 'remove-users' ); ?> 408 <?php echo $referer; ?> 409 410 <div class="wrap"> 411 <h1><?php _e( 'Remove Users from Site' ); ?></h1> 412 413 <?php if ( 1 === count( $userids ) ) : ?> 414 <p><?php _e( 'You have specified this user for removal:' ); ?></p> 415 <?php else : ?> 416 <p><?php _e( 'You have specified these users for removal:' ); ?></p> 417 <?php endif; ?> 418 419 <ul> 420 <?php 421 $go_remove = false; 422 foreach ( $userids as $id ) { 423 $id = (int) $id; 424 $user = get_userdata( $id ); 425 if ( ! current_user_can( 'remove_user', $id ) ) { 426 /* translators: 1: User ID, 2: User login. */ 427 echo '<li>' . sprintf( __( 'ID #%1$s: %2$s <strong>Sorry, you are not allowed to remove this user.</strong>' ), $id, $user->user_login ) . "</li>\n"; 428 } else { 429 /* translators: 1: User ID, 2: User login. */ 430 echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />" . sprintf( __( 'ID #%1$s: %2$s' ), $id, $user->user_login ) . "</li>\n"; 431 $go_remove = true; 432 } 433 } 434 ?> 435 </ul> 436 <?php if ( $go_remove ) : ?> 437 <input type="hidden" name="action" value="doremove" /> 438 <?php submit_button( __( 'Confirm Removal' ), 'primary' ); ?> 439 <?php else : ?> 440 <p><?php _e( 'There are no valid users selected for removal.' ); ?></p> 441 <?php endif; ?> 442 </div> 443 </form> 444 <?php 445 446 break; 447 448 default: 449 if ( ! empty( $_GET['_wp_http_referer'] ) ) { 450 wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ); 451 exit; 452 } 453 454 if ( $wp_list_table->current_action() && ! empty( $_REQUEST['users'] ) ) { 455 $screen = get_current_screen()->id; 456 $sendback = wp_get_referer(); 457 $userids = $_REQUEST['users']; 458 459 /** This action is documented in wp-admin/edit.php */ 460 $sendback = apply_filters( "handle_bulk_actions-{$screen}", $sendback, $wp_list_table->current_action(), $userids ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores 461 462 wp_safe_redirect( $sendback ); 463 exit; 464 } 465 466 $wp_list_table->prepare_items(); 467 $total_pages = $wp_list_table->get_pagination_arg( 'total_pages' ); 468 if ( $pagenum > $total_pages && $total_pages > 0 ) { 469 wp_redirect( add_query_arg( 'paged', $total_pages ) ); 470 exit; 471 } 472 473 require_once ABSPATH . 'wp-admin/admin-header.php'; 474 475 $messages = array(); 476 if ( isset( $_GET['update'] ) ) : 477 switch ( $_GET['update'] ) { 478 case 'del': 479 case 'del_many': 480 $delete_count = isset( $_GET['delete_count'] ) ? (int) $_GET['delete_count'] : 0; 481 if ( 1 == $delete_count ) { 482 $message = __( 'User deleted.' ); 483 } else { 484 /* translators: %s: Number of users. */ 485 $message = _n( '%s user deleted.', '%s users deleted.', $delete_count ); 486 } 487 $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . sprintf( $message, number_format_i18n( $delete_count ) ) . '</p></div>'; 488 break; 489 case 'add': 490 $message = __( 'New user created.' ); 491 492 $user_id = isset( $_GET['id'] ) ? $_GET['id'] : false; 493 if ( $user_id && current_user_can( 'edit_user', $user_id ) ) { 494 $message .= sprintf( 495 ' <a href="%s">%s</a>', 496 esc_url( 497 add_query_arg( 498 'wp_http_referer', 499 urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), 500 self_admin_url( 'user-edit.php?user_id=' . $user_id ) 501 ) 502 ), 503 __( 'Edit user' ) 504 ); 505 } 506 507 $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . $message . '</p></div>'; 508 break; 509 case 'promote': 510 $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . __( 'Changed roles.' ) . '</p></div>'; 511 break; 512 case 'err_admin_role': 513 $messages[] = '<div id="message" class="error notice is-dismissible"><p>' . __( 'The current user’s role must have user editing capabilities.' ) . '</p></div>'; 514 $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . __( 'Other user roles have been changed.' ) . '</p></div>'; 515 break; 516 case 'err_admin_del': 517 $messages[] = '<div id="message" class="error notice is-dismissible"><p>' . __( 'You can’t delete the current user.' ) . '</p></div>'; 518 $messages[] = '<div id="message" class="updated notice is-dismissible"><p>' . __( 'Other users have been deleted.' ) . '</p></div>'; 519 break; 520 case 'remove': 521 $messages[] = '<div id="message" class="updated notice is-dismissible fade"><p>' . __( 'User removed from this site.' ) . '</p></div>'; 522 break; 523 case 'err_admin_remove': 524 $messages[] = '<div id="message" class="error notice is-dismissible"><p>' . __( "You can't remove the current user." ) . '</p></div>'; 525 $messages[] = '<div id="message" class="updated notice is-dismissible fade"><p>' . __( 'Other users have been removed.' ) . '</p></div>'; 526 break; 527 } 528 endif; 529 ?> 530 531 <?php if ( isset( $errors ) && is_wp_error( $errors ) ) : ?> 532 <div class="error"> 533 <ul> 534 <?php 535 foreach ( $errors->get_error_messages() as $err ) { 536 echo "<li>$err</li>\n"; 537 } 538 ?> 539 </ul> 540 </div> 541 <?php 542 endif; 543 544 if ( ! empty( $messages ) ) { 545 foreach ( $messages as $msg ) { 546 echo $msg; 547 } 548 } 549 ?> 550 551 <div class="wrap"> 552 <h1 class="wp-heading-inline"> 553 <?php 554 echo esc_html( $title ); 555 ?> 556 </h1> 557 558 <?php 559 if ( current_user_can( 'create_users' ) ) { 560 ?> 561 <a href="<?php echo admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a> 562 <?php } elseif ( is_multisite() && current_user_can( 'promote_users' ) ) { ?> 563 <a href="<?php echo admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add Existing', 'user' ); ?></a> 564 <?php 565 } 566 567 if ( strlen( $usersearch ) ) { 568 echo '<span class="subtitle">'; 569 printf( 570 /* translators: %s: Search query. */ 571 __( 'Search results for: %s' ), 572 '<strong>' . esc_html( $usersearch ) . '</strong>' 573 ); 574 echo '</span>'; 575 } 576 ?> 577 578 <hr class="wp-header-end"> 579 580 <?php $wp_list_table->views(); ?> 581 582 <form method="get"> 583 584 <?php $wp_list_table->search_box( __( 'Search Users' ), 'user' ); ?> 585 586 <?php if ( ! empty( $_REQUEST['role'] ) ) { ?> 587 <input type="hidden" name="role" value="<?php echo esc_attr( $_REQUEST['role'] ); ?>" /> 588 <?php } ?> 589 590 <?php $wp_list_table->display(); ?> 591 </form> 592 593 <div class="clear" /></div> 594 </div> 595 <?php 596 break; 597 598 } // End of the $doaction switch. 599 600 require_once ABSPATH . 'wp-admin/admin-footer.php';
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
Generated: Thu Jan 21 01:00:10 2021 | Cross-referenced by PHPXref 0.7.1 |