diff -r 34716fd837a4 -r be944660c56a wp/wp-admin/users.php --- a/wp/wp-admin/users.php Tue Dec 15 15:52:01 2020 +0100 +++ b/wp/wp-admin/users.php Wed Sep 21 18:19:35 2022 +0200 @@ -112,17 +112,21 @@ } $editable_roles = get_editable_roles(); - $role = false; - if ( ! empty( $_REQUEST['new_role2'] ) ) { - $role = $_REQUEST['new_role2']; - } elseif ( ! empty( $_REQUEST['new_role'] ) ) { - $role = $_REQUEST['new_role']; - } + $role = $_REQUEST['new_role']; + + // Mocking the `none` role so we are able to save it to the database + $editable_roles['none'] = array( + 'name' => __( '— No role for this site —' ), + ); if ( ! $role || empty( $editable_roles[ $role ] ) ) { wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 ); } + if ( 'none' === $role ) { + $role = ''; + } + $userids = $_REQUEST['users']; $update = 'promote'; foreach ( $userids as $id ) { @@ -213,6 +217,46 @@ wp_redirect( $redirect ); exit; + case 'resetpassword': + check_admin_referer( 'bulk-users' ); + if ( ! current_user_can( 'edit_users' ) ) { + $errors = new WP_Error( 'edit_users', __( 'Sorry, you are not allowed to edit users.' ) ); + } + if ( empty( $_REQUEST['users'] ) ) { + wp_redirect( $redirect ); + exit(); + } + $userids = array_map( 'intval', (array) $_REQUEST['users'] ); + + $reset_count = 0; + + foreach ( $userids as $id ) { + if ( ! current_user_can( 'edit_user', $id ) ) { + wp_die( __( 'Sorry, you are not allowed to edit this user.' ) ); + } + + if ( $id === $current_user->ID ) { + $update = 'err_admin_reset'; + continue; + } + + // Send the password reset link. + $user = get_userdata( $id ); + if ( retrieve_password( $user->user_login ) ) { + ++$reset_count; + } + } + + $redirect = add_query_arg( + array( + 'reset_count' => $reset_count, + 'update' => 'resetpassword', + ), + $redirect + ); + wp_redirect( $redirect ); + exit; + case 'delete': if ( is_multisite() ) { wp_die( __( 'User deletion is not allowed from this screen.' ), 400 ); @@ -230,7 +274,7 @@ } if ( empty( $_REQUEST['users'] ) ) { - $userids = array( intval( $_REQUEST['user'] ) ); + $userids = array( (int) $_REQUEST['user'] ); } else { $userids = array_map( 'intval', (array) $_REQUEST['users'] ); } @@ -401,7 +445,7 @@ } if ( empty( $_REQUEST['users'] ) ) { - $userids = array( intval( $_REQUEST['user'] ) ); + $userids = array( (int) $_REQUEST['user'] ); } else { $userids = $_REQUEST['users']; } @@ -511,6 +555,16 @@ $messages[] = '
' . $message . '
' . sprintf( $message, number_format_i18n( $reset_count ) ) . '
' . __( 'Changed roles.' ) . '