User Role Editor - Version 4.36.1

Version Description

Download this release

Release Info

Developer shinephp
Plugin Icon 128x128 User Role Editor
Version 4.36.1
Comparing to
See all releases

Code changes from version 4.36 to 4.36.1

Files changed (8) hide show
  1. includes/classes/protect-admin.php +5 -5
  2. includes/classes/role-additional-options.php +2 -2
  3. includes/classes/role-view.php +1 -2
  4. includes/classes/ure-lib.php +21 -30
  5. includes/classes/user-other-roles.php +5 -8
  6. includes/classes/user-role-editor.php +26 -31
  7. readme.txt +5 -2
  8. user-role-editor.php +2 -2
includes/classes/protect-admin.php CHANGED
@@ -14,10 +14,10 @@ class URE_Protect_Admin {
14
  private $lib = null;
15
  private $user_to_check = null; // cached list of user IDs, who has Administrator role
16
 
17
- public function __construct($lib) {
18
  global $pagenow;
19
 
20
- $this->lib = $lib;
21
  $this->user_to_check = array();
22
 
23
  // Exclude administrator role from edit list.
@@ -158,20 +158,20 @@ class URE_Protect_Admin {
158
  * @param type $user_query
159
  */
160
  public function exclude_administrators($user_query) {
161
-
162
- global $wpdb, $current_user;
163
 
164
  if (!$this->is_protection_applicable()) { // block the user edit stuff only
165
  return;
166
  }
167
 
168
  // get user_id of users with 'Administrator' role
 
169
  $tableName = $this->lib->get_usermeta_table_name();
170
  $meta_key = $wpdb->prefix . 'capabilities';
171
  $admin_role_key = '%"administrator"%';
172
  $query = "SELECT user_id
173
  FROM $tableName
174
- WHERE user_id!={$current_user->ID} AND meta_key='{$meta_key}' AND meta_value like '{$admin_role_key}'";
175
  $ids_arr = $wpdb->get_col($query);
176
  if (is_array($ids_arr) && count($ids_arr) > 0) {
177
  $ids = implode(',', $ids_arr);
14
  private $lib = null;
15
  private $user_to_check = null; // cached list of user IDs, who has Administrator role
16
 
17
+ public function __construct() {
18
  global $pagenow;
19
 
20
+ $this->lib = URE_Lib::get_instance();
21
  $this->user_to_check = array();
22
 
23
  // Exclude administrator role from edit list.
158
  * @param type $user_query
159
  */
160
  public function exclude_administrators($user_query) {
161
+ global $wpdb;
 
162
 
163
  if (!$this->is_protection_applicable()) { // block the user edit stuff only
164
  return;
165
  }
166
 
167
  // get user_id of users with 'Administrator' role
168
+ $current_user_id = get_current_user_id();
169
  $tableName = $this->lib->get_usermeta_table_name();
170
  $meta_key = $wpdb->prefix . 'capabilities';
171
  $admin_role_key = '%"administrator"%';
172
  $query = "SELECT user_id
173
  FROM $tableName
174
+ WHERE user_id!={$current_user_id} AND meta_key='{$meta_key}' AND meta_value like '{$admin_role_key}'";
175
  $ids_arr = $wpdb->get_col($query);
176
  if (is_array($ids_arr) && count($ids_arr) > 0) {
177
  $ids = implode(',', $ids_arr);
includes/classes/role-additional-options.php CHANGED
@@ -8,7 +8,7 @@ class URE_Role_Additional_Options {
8
  private $active_items = null;
9
  const STORAGE_ID = 'ure_role_additional_options_values';
10
 
11
- public function __construct($lib) {
12
 
13
  $this->lib = $lib;
14
  $this->init();
@@ -78,12 +78,12 @@ class URE_Role_Additional_Options {
78
 
79
 
80
  public function set_active_items_hooks() {
81
- global $current_user;
82
 
83
  if (current_user_can('ure_edit_roles')) {
84
  return;
85
  }
86
 
 
87
  foreach($current_user->roles as $role) {
88
  if (!isset($this->active_items[$role])) {
89
  continue;
8
  private $active_items = null;
9
  const STORAGE_ID = 'ure_role_additional_options_values';
10
 
11
+ private function __construct($lib) {
12
 
13
  $this->lib = $lib;
14
  $this->init();
78
 
79
 
80
  public function set_active_items_hooks() {
 
81
 
82
  if (current_user_can('ure_edit_roles')) {
83
  return;
84
  }
85
 
86
+ $current_user = wp_get_current_user();
87
  foreach($current_user->roles as $role) {
88
  if (!isset($this->active_items[$role])) {
89
  continue;
includes/classes/role-view.php CHANGED
@@ -63,8 +63,7 @@ class URE_Role_View extends URE_View {
63
 
64
  private function role_select_copy_prepare_html($select_width=200) {
65
 
66
- global $current_user;
67
-
68
  $key_capability = URE_Own_Capabilities::get_key_capability();
69
  $user_is_ure_admin = current_user_can($key_capability);
70
  $role_to_skip = ($user_is_ure_admin) ? '':$current_user->roles[0];
63
 
64
  private function role_select_copy_prepare_html($select_width=200) {
65
 
66
+ $current_user = wp_get_current_user();
 
67
  $key_capability = URE_Own_Capabilities::get_key_capability();
68
  $user_is_ure_admin = current_user_can($key_capability);
69
  $role_to_skip = ($user_is_ure_admin) ? '':$current_user->roles[0];
includes/classes/ure-lib.php CHANGED
@@ -137,8 +137,7 @@ class URE_Lib extends URE_Base_Lib {
137
  * User Role Editor stores its options at the main blog/site only and applies them to the all network
138
  *
139
  */
140
- protected function init_options($options_id) {
141
-
142
  global $wpdb;
143
 
144
  if ($this->multisite) {
@@ -171,7 +170,6 @@ class URE_Lib extends URE_Base_Lib {
171
  * saves options array into WordPress database wp_options table
172
  */
173
  public function flush_options() {
174
-
175
  global $wpdb;
176
 
177
  $current_blog = $wpdb->blogid;
@@ -573,16 +571,14 @@ class URE_Lib extends URE_Base_Lib {
573
  /**
574
  * Checks if user is allowed to use User Role Editor
575
  *
576
- * @global int $current_user
577
  * @param int $user_id
578
  * @return boolean true
579
  */
580
  public function user_is_admin($user_id = false) {
581
- global $current_user;
582
 
583
  $ure_key_capability = URE_Own_Capabilities::get_key_capability();
584
  if (empty($user_id)) {
585
- $user_id = $current_user->ID;
586
  }
587
  $result = user_can($user_id, $ure_key_capability);
588
 
@@ -600,7 +596,6 @@ class URE_Lib extends URE_Base_Lib {
600
  * @return array
601
  */
602
  public function get_user_roles() {
603
-
604
  global $wp_roles;
605
 
606
  if (!isset($wp_roles)) {
@@ -706,8 +701,7 @@ class URE_Lib extends URE_Base_Lib {
706
  // ure_ConvertCapsToReadable
707
 
708
 
709
- public function make_roles_backup()
710
- {
711
  global $wpdb;
712
 
713
  // check if backup user roles record exists already
@@ -764,7 +758,6 @@ class URE_Lib extends URE_Base_Lib {
764
  /**
765
  * return array with roles which we could delete, e.g self-created and not used with any blog user
766
  *
767
- * @global wpdb $wpdb - WP database object
768
  * @return array
769
  */
770
  public function get_roles_can_delete() {
@@ -818,7 +811,6 @@ class URE_Lib extends URE_Base_Lib {
818
  * return the array of unused user capabilities
819
  *
820
  * @global WP_Roles $wp_roles
821
- * @global wpdb $wpdb
822
  * @return array
823
  */
824
  public function get_caps_to_remove() {
@@ -904,7 +896,6 @@ class URE_Lib extends URE_Base_Lib {
904
  *
905
  */
906
  protected function validate_user_roles() {
907
-
908
  global $wp_roles;
909
 
910
  $default_role = get_option('default_role');
@@ -1100,8 +1091,7 @@ class URE_Lib extends URE_Base_Lib {
1100
  // end of get_edit_post_capabilities();
1101
 
1102
 
1103
- protected function add_custom_post_type_caps() {
1104
-
1105
  global $wp_roles;
1106
 
1107
  $capabilities = $this->get_edit_post_capabilities();
@@ -1250,22 +1240,28 @@ class URE_Lib extends URE_Base_Lib {
1250
  // end of is_full_network_synch()
1251
 
1252
 
1253
- protected function last_check_before_update() {
1254
- global $current_user;
1255
 
1256
  if (empty($this->roles) || !is_array($this->roles) || count($this->roles)==0) { // Nothing to save - something goes wrong - stop ...
1257
  return false;
1258
  }
1259
 
1260
  $key_capability = URE_Own_Capabilities::get_key_capability();
1261
- $user_is_ure_admin = current_user_can($key_capability);
1262
- if (!$user_is_ure_admin) {
1263
- if (in_array($this->current_role, $current_user->roles)) {
1264
- // do not allow to a user update his own role if he does not have full access to the User Role Editor
1265
- return false;
1266
- }
1267
  }
1268
 
 
 
 
 
 
 
 
1269
  return true;
1270
  }
1271
  // end of last_check_before_update()
@@ -1405,7 +1401,7 @@ class URE_Lib extends URE_Base_Lib {
1405
  /**
1406
  * Process user request on update roles
1407
  *
1408
- * @global wpdb $wpdb
1409
  * @return boolean
1410
  */
1411
  protected function update_roles() {
@@ -1482,7 +1478,6 @@ class URE_Lib extends URE_Base_Lib {
1482
  *
1483
  */
1484
  protected function add_new_role() {
1485
-
1486
  global $wp_roles;
1487
 
1488
  if (!current_user_can('ure_create_roles')) {
@@ -1549,7 +1544,6 @@ class URE_Lib extends URE_Base_Lib {
1549
  *
1550
  */
1551
  protected function rename_role() {
1552
-
1553
  global $wp_roles;
1554
 
1555
  $mess = '';
@@ -1643,9 +1637,8 @@ class URE_Lib extends URE_Base_Lib {
1643
 
1644
 
1645
  /**
1646
- * process user request for user role deletion
1647
- * @global WP_Roles $wp_roles
1648
- * @return type
1649
  */
1650
  protected function delete_role() {
1651
 
@@ -2033,7 +2026,6 @@ class URE_Lib extends URE_Base_Lib {
2033
  * which counts any user with 'delete_users' capability as a superadmin.
2034
  *
2035
  * @param int $user_id
2036
- * @global WP_User $current_user
2037
  * @return boolean
2038
  */
2039
  public function is_super_admin($user_id = false) {
@@ -2065,7 +2057,6 @@ class URE_Lib extends URE_Base_Lib {
2065
  // Returns true if user has $capability assigned through the roles or directly
2066
  // Returns true if user has role with name equal $cap
2067
  public function user_has_capability($user, $cap) {
2068
-
2069
  global $wp_roles;
2070
 
2071
  if (!is_object($user) || empty($user->ID)) {
137
  * User Role Editor stores its options at the main blog/site only and applies them to the all network
138
  *
139
  */
140
+ protected function init_options($options_id) {
 
141
  global $wpdb;
142
 
143
  if ($this->multisite) {
170
  * saves options array into WordPress database wp_options table
171
  */
172
  public function flush_options() {
 
173
  global $wpdb;
174
 
175
  $current_blog = $wpdb->blogid;
571
  /**
572
  * Checks if user is allowed to use User Role Editor
573
  *
 
574
  * @param int $user_id
575
  * @return boolean true
576
  */
577
  public function user_is_admin($user_id = false) {
 
578
 
579
  $ure_key_capability = URE_Own_Capabilities::get_key_capability();
580
  if (empty($user_id)) {
581
+ $user_id = get_current_user_id();
582
  }
583
  $result = user_can($user_id, $ure_key_capability);
584
 
596
  * @return array
597
  */
598
  public function get_user_roles() {
 
599
  global $wp_roles;
600
 
601
  if (!isset($wp_roles)) {
701
  // ure_ConvertCapsToReadable
702
 
703
 
704
+ public function make_roles_backup() {
 
705
  global $wpdb;
706
 
707
  // check if backup user roles record exists already
758
  /**
759
  * return array with roles which we could delete, e.g self-created and not used with any blog user
760
  *
 
761
  * @return array
762
  */
763
  public function get_roles_can_delete() {
811
  * return the array of unused user capabilities
812
  *
813
  * @global WP_Roles $wp_roles
 
814
  * @return array
815
  */
816
  public function get_caps_to_remove() {
896
  *
897
  */
898
  protected function validate_user_roles() {
 
899
  global $wp_roles;
900
 
901
  $default_role = get_option('default_role');
1091
  // end of get_edit_post_capabilities();
1092
 
1093
 
1094
+ protected function add_custom_post_type_caps() {
 
1095
  global $wp_roles;
1096
 
1097
  $capabilities = $this->get_edit_post_capabilities();
1240
  // end of is_full_network_synch()
1241
 
1242
 
1243
+ protected function last_check_before_update() {
 
1244
 
1245
  if (empty($this->roles) || !is_array($this->roles) || count($this->roles)==0) { // Nothing to save - something goes wrong - stop ...
1246
  return false;
1247
  }
1248
 
1249
  $key_capability = URE_Own_Capabilities::get_key_capability();
1250
+ if (current_user_can($key_capability)) { // current user is an URE admin
1251
+ return true;
1252
+ }
1253
+
1254
+ if (!current_user_can('ure_edit_roles')) {
1255
+ return false;
1256
  }
1257
 
1258
+ $current_user = wp_get_current_user();
1259
+ if (in_array($this->current_role, $current_user->roles)) {
1260
+ // do not allow to non-admin user without full access to URE update his own role
1261
+ return false;
1262
+ }
1263
+
1264
+
1265
  return true;
1266
  }
1267
  // end of last_check_before_update()
1401
  /**
1402
  * Process user request on update roles
1403
  *
1404
+ * @global WP_Roles $wp_roles
1405
  * @return boolean
1406
  */
1407
  protected function update_roles() {
1478
  *
1479
  */
1480
  protected function add_new_role() {
 
1481
  global $wp_roles;
1482
 
1483
  if (!current_user_can('ure_create_roles')) {
1544
  *
1545
  */
1546
  protected function rename_role() {
 
1547
  global $wp_roles;
1548
 
1549
  $mess = '';
1637
 
1638
 
1639
  /**
1640
+ * Process user request for user role deletion
1641
+ * @return string
 
1642
  */
1643
  protected function delete_role() {
1644
 
2026
  * which counts any user with 'delete_users' capability as a superadmin.
2027
  *
2028
  * @param int $user_id
 
2029
  * @return boolean
2030
  */
2031
  public function is_super_admin($user_id = false) {
2057
  // Returns true if user has $capability assigned through the roles or directly
2058
  // Returns true if user has role with name equal $cap
2059
  public function user_has_capability($user, $cap) {
 
2060
  global $wp_roles;
2061
 
2062
  if (!is_object($user) || empty($user->ID)) {
includes/classes/user-other-roles.php CHANGED
@@ -124,8 +124,7 @@ class URE_User_Other_Roles {
124
  // end of get_roles_array()
125
 
126
 
127
- private function roles_select_html($user, $context) {
128
-
129
  global $wp_roles;
130
 
131
  $user_roles = $user->roles;
@@ -165,8 +164,8 @@ class URE_User_Other_Roles {
165
 
166
 
167
  private function user_profile_capabilities($user) {
168
- global $current_user;
169
 
 
170
  $user_caps = $this->lib->get_edited_user_caps($user);
171
  ?>
172
  <tr>
@@ -176,7 +175,7 @@ class URE_User_Other_Roles {
176
  <td>
177
  <?php
178
  echo $user_caps .'<br/>';
179
- if ($this->lib->user_is_admin($current_user->ID)) {
180
  echo '<a href="' . wp_nonce_url("users.php?page=users-".URE_PLUGIN_FILE."&object=user&amp;user_id={$user->ID}", "ure_user_{$user->ID}") . '">' .
181
  esc_html__('Edit', 'user-role-editor') . '</a>';
182
  }
@@ -214,7 +213,6 @@ class URE_User_Other_Roles {
214
  /**
215
  * Add URE stuff to the edit user profile page
216
  *
217
- * @global object $current_user
218
  * @param object $user
219
  * @return void
220
  */
@@ -232,7 +230,7 @@ class URE_User_Other_Roles {
232
  <?php
233
  $this->display($user, 'user-edit');
234
  }
235
- // end of edit_user_profile()
236
 
237
 
238
  public function user_new_form($context) {
@@ -250,12 +248,11 @@ class URE_User_Other_Roles {
250
  </table>
251
  <?php
252
  }
253
- // end of edit_user_profile_html()
254
 
255
 
256
  // save additional user roles when user profile is updated, as WordPress itself doesn't know about them
257
  public function update($user_id) {
258
-
259
  global $wp_roles;
260
 
261
  if (!current_user_can('edit_users')) {
124
  // end of get_roles_array()
125
 
126
 
127
+ private function roles_select_html($user, $context) {
 
128
  global $wp_roles;
129
 
130
  $user_roles = $user->roles;
164
 
165
 
166
  private function user_profile_capabilities($user) {
 
167
 
168
+ $current_user_id = get_current_user_id();
169
  $user_caps = $this->lib->get_edited_user_caps($user);
170
  ?>
171
  <tr>
175
  <td>
176
  <?php
177
  echo $user_caps .'<br/>';
178
+ if ($this->lib->user_is_admin($current_user_id)) {
179
  echo '<a href="' . wp_nonce_url("users.php?page=users-".URE_PLUGIN_FILE."&object=user&amp;user_id={$user->ID}", "ure_user_{$user->ID}") . '">' .
180
  esc_html__('Edit', 'user-role-editor') . '</a>';
181
  }
213
  /**
214
  * Add URE stuff to the edit user profile page
215
  *
 
216
  * @param object $user
217
  * @return void
218
  */
230
  <?php
231
  $this->display($user, 'user-edit');
232
  }
233
+ // end of edit_user_profile_html()
234
 
235
 
236
  public function user_new_form($context) {
248
  </table>
249
  <?php
250
  }
251
+ // end of user_new_form()
252
 
253
 
254
  // save additional user roles when user profile is updated, as WordPress itself doesn't know about them
255
  public function update($user_id) {
 
256
  global $wp_roles;
257
 
258
  if (!current_user_can('edit_users')) {
includes/classes/user-role-editor.php CHANGED
@@ -153,19 +153,14 @@ class User_Role_Editor {
153
  */
154
  public function plugin_init() {
155
 
156
- global $current_user, $pagenow;
157
-
158
- if (!empty($current_user->ID)) {
159
- $user_id = $current_user->ID;
160
- } else {
161
- $user_id = 0;
162
- }
163
 
 
164
  $supress_protection = apply_filters('ure_supress_administrators_protection', false);
165
  // these filters and actions should prevent editing users with administrator role
166
  // by other users with 'edit_users' capability
167
  if (!$supress_protection && !$this->lib->user_is_admin($user_id)) {
168
- new URE_Protect_Admin($this->lib);
169
  }
170
 
171
  add_action('admin_enqueue_scripts', array($this, 'admin_load_js'));
@@ -207,13 +202,12 @@ class User_Role_Editor {
207
  * Allow non-superadmin user to add/create users to the site as superadmin does.
208
  * Include current user to the list of superadmins - for the user-new.php page only, and
209
  * if user really can create_users and promote_users
210
- * @global string $page
211
  * @param array $site_admins
212
  * @return array
213
  */
214
- public function allow_add_user_as_superadmin($site_admins) {
215
-
216
- global $pagenow, $current_user;
217
 
218
  $this->lib->set_raised_permissions(false);
219
 
@@ -229,14 +223,14 @@ class User_Role_Editor {
229
  if (!$can_add_user) {
230
  return $site_admins; // no help in this case
231
  }
232
-
 
233
  if (!in_array($current_user->user_login, $site_admins)) {
234
  $this->lib->set_raised_permissions(true);
235
  $site_admins[] = $current_user->user_login;
236
  }
237
 
238
- return $site_admins;
239
-
240
  }
241
  // end of allow_add_user_as_superadmin()
242
 
@@ -341,10 +335,10 @@ class User_Role_Editor {
341
  *
342
  */
343
  public function edit_user_permission_check() {
344
- global $current_user, $profileuser;
345
 
346
- wp_get_current_user();
347
- if ($current_user->ID===0) {
348
  return;
349
  }
350
  if ($this->lib->is_super_admin()) { // Superadmin may do all
@@ -361,9 +355,9 @@ class User_Role_Editor {
361
  }
362
 
363
  // editing a user profile: it's correct to call is_super_admin() directly here, as permissions are raised for the $current_user only
364
- if (!$this->lib->is_super_admin($current_user->ID) && is_super_admin($profileuser->ID)) { // trying to edit a superadmin while himself is less than a superadmin
365
  wp_die(esc_html__('You do not have permission to edit this user.', 'user-role-editor'));
366
- } elseif (!( is_user_member_of_blog($profileuser->ID, get_current_blog_id()) && is_user_member_of_blog($current_user->ID, get_current_blog_id()) )) { // editing user and edited user aren't members of the same blog
367
  wp_die(esc_html__('You do not have permission to edit this user.', 'user-role-editor'));
368
  }
369
 
@@ -375,30 +369,31 @@ class User_Role_Editor {
375
  * Add/hide edit actions for every user row at the users list
376
  *
377
  * @global type $pagenow
378
- * @global type $current_user
379
  * @param string $actions
380
  * @param type $user
381
  * @return string
382
  */
383
  public function user_row($actions, $user) {
 
384
 
385
- global $pagenow, $current_user;
386
-
387
- if ($pagenow == 'users.php') {
388
- if ($current_user->has_cap($this->key_capability)) {
389
- $actions['capabilities'] = '<a href="' .
390
- wp_nonce_url("users.php?page=users-" . URE_PLUGIN_FILE . "&object=user&amp;user_id={$user->ID}", "ure_user_{$user->ID}") .
391
- '">' . esc_html__('Capabilities', 'user-role-editor') . '</a>';
392
- }
393
  }
394
-
 
 
 
 
 
 
 
395
  return $actions;
396
  }
397
 
398
  // end of user_row()
399
 
400
 
401
- /**
402
  * every time when new blog created - duplicate to it roles from the main blog (1)
403
  * @global wpdb $wpdb
404
  * @global WP_Roles $wp_roles
153
  */
154
  public function plugin_init() {
155
 
156
+ global $pagenow;
 
 
 
 
 
 
157
 
158
+ $user_id = get_current_user_id();
159
  $supress_protection = apply_filters('ure_supress_administrators_protection', false);
160
  // these filters and actions should prevent editing users with administrator role
161
  // by other users with 'edit_users' capability
162
  if (!$supress_protection && !$this->lib->user_is_admin($user_id)) {
163
+ new URE_Protect_Admin();
164
  }
165
 
166
  add_action('admin_enqueue_scripts', array($this, 'admin_load_js'));
202
  * Allow non-superadmin user to add/create users to the site as superadmin does.
203
  * Include current user to the list of superadmins - for the user-new.php page only, and
204
  * if user really can create_users and promote_users
205
+ * @global string $pagenow
206
  * @param array $site_admins
207
  * @return array
208
  */
209
+ public function allow_add_user_as_superadmin($site_admins) {
210
+ global $pagenow;
 
211
 
212
  $this->lib->set_raised_permissions(false);
213
 
223
  if (!$can_add_user) {
224
  return $site_admins; // no help in this case
225
  }
226
+
227
+ $current_user = wp_get_current_user();
228
  if (!in_array($current_user->user_login, $site_admins)) {
229
  $this->lib->set_raised_permissions(true);
230
  $site_admins[] = $current_user->user_login;
231
  }
232
 
233
+ return $site_admins;
 
234
  }
235
  // end of allow_add_user_as_superadmin()
236
 
335
  *
336
  */
337
  public function edit_user_permission_check() {
338
+ global $profileuser;
339
 
340
+ $current_user_id = get_current_user_id();
341
+ if ($current_user_id===0) {
342
  return;
343
  }
344
  if ($this->lib->is_super_admin()) { // Superadmin may do all
355
  }
356
 
357
  // editing a user profile: it's correct to call is_super_admin() directly here, as permissions are raised for the $current_user only
358
+ if (!$this->lib->is_super_admin($current_user_id) && is_super_admin($profileuser->ID)) { // trying to edit a superadmin while himself is less than a superadmin
359
  wp_die(esc_html__('You do not have permission to edit this user.', 'user-role-editor'));
360
+ } elseif (!( is_user_member_of_blog($profileuser->ID, get_current_blog_id()) && is_user_member_of_blog($current_user_id, get_current_blog_id()) )) { // editing user and edited user aren't members of the same blog
361
  wp_die(esc_html__('You do not have permission to edit this user.', 'user-role-editor'));
362
  }
363
 
369
  * Add/hide edit actions for every user row at the users list
370
  *
371
  * @global type $pagenow
 
372
  * @param string $actions
373
  * @param type $user
374
  * @return string
375
  */
376
  public function user_row($actions, $user) {
377
+ global $pagenow;
378
 
379
+ if ($pagenow!=='users.php') {
380
+ return $actions;
 
 
 
 
 
 
381
  }
382
+
383
+ $current_user = wp_get_current_user();
384
+ if ($current_user->has_cap($this->key_capability)) {
385
+ $actions['capabilities'] = '<a href="' .
386
+ wp_nonce_url("users.php?page=users-" . URE_PLUGIN_FILE . "&object=user&amp;user_id={$user->ID}", "ure_user_{$user->ID}") .
387
+ '">' . esc_html__('Capabilities', 'user-role-editor') . '</a>';
388
+ }
389
+
390
  return $actions;
391
  }
392
 
393
  // end of user_row()
394
 
395
 
396
+ /**
397
  * every time when new blog created - duplicate to it roles from the main blog (1)
398
  * @global wpdb $wpdb
399
  * @global WP_Roles $wp_roles
readme.txt CHANGED
@@ -3,8 +3,8 @@ Contributors: shinephp
3
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=vladimir%40shinephp%2ecom&lc=RU&item_name=ShinePHP%2ecom&item_number=User%20Role%20Editor%20WordPress%20plugin&currency_code=USD&bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted
4
  Tags: user, role, editor, security, access, permission, capability
5
  Requires at least: 4.0
6
- Tested up to: 4.8.1
7
- Stable tag: 4.36
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
@@ -79,6 +79,9 @@ https://translate.wordpress.org/projects/wp-plugins/user-role-editor/
79
 
80
  == Changelog =
81
 
 
 
 
82
  = [4.36] 19.09.2017 =
83
  * New: It's possible to set any URE's option value programmatically: use custom filter 'ure_get_option_<option_name>'. It takes a single parameter with current/default value for required options.
84
  Full list of User Role Editor options is available here: https://www.role-editor.com/documentation/options-list
3
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=vladimir%40shinephp%2ecom&lc=RU&item_name=ShinePHP%2ecom&item_number=User%20Role%20Editor%20WordPress%20plugin&currency_code=USD&bn=PP%2dDonationsBF%3abtn_donateCC_LG%2egif%3aNonHosted
4
  Tags: user, role, editor, security, access, permission, capability
5
  Requires at least: 4.0
6
+ Tested up to: 4.8.2
7
+ Stable tag: 4.36.1
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
79
 
80
  == Changelog =
81
 
82
+ = [4.36.1] 02.10.2017 =
83
+ * Update: Direct access to the global $current_user variable was excluded. Current user data is initialized via WordPress core functions wp_get_current_user() or get_current_user_id().
84
+
85
  = [4.36] 19.09.2017 =
86
  * New: It's possible to set any URE's option value programmatically: use custom filter 'ure_get_option_<option_name>'. It takes a single parameter with current/default value for required options.
87
  Full list of User Role Editor options is available here: https://www.role-editor.com/documentation/options-list
user-role-editor.php CHANGED
@@ -3,7 +3,7 @@
3
  Plugin Name: User Role Editor
4
  Plugin URI: https://www.role-editor.com
5
  Description: Change/add/delete WordPress user roles and capabilities.
6
- Version: 4.36
7
  Author: Vladimir Garagulya
8
  Author URI: https://www.role-editor.com
9
  Text Domain: ure
@@ -23,7 +23,7 @@ if (defined('URE_PLUGIN_URL')) {
23
  wp_die('It seems that other version of User Role Editor is active. Please deactivate it before use this version');
24
  }
25
 
26
- define('URE_VERSION', '4.36');
27
  define('URE_PLUGIN_URL', plugin_dir_url(__FILE__));
28
  define('URE_PLUGIN_DIR', plugin_dir_path(__FILE__));
29
  define('URE_PLUGIN_BASE_NAME', plugin_basename(__FILE__));
3
  Plugin Name: User Role Editor
4
  Plugin URI: https://www.role-editor.com
5
  Description: Change/add/delete WordPress user roles and capabilities.
6
+ Version: 4.36.1
7
  Author: Vladimir Garagulya
8
  Author URI: https://www.role-editor.com
9
  Text Domain: ure
23
  wp_die('It seems that other version of User Role Editor is active. Please deactivate it before use this version');
24
  }
25
 
26
+ define('URE_VERSION', '4.36.1');
27
  define('URE_PLUGIN_URL', plugin_dir_url(__FILE__));
28
  define('URE_PLUGIN_DIR', plugin_dir_path(__FILE__));
29
  define('URE_PLUGIN_BASE_NAME', plugin_basename(__FILE__));