23 if ( func_num_args() ) { // The hackiest hack that ever did hack |
23 if ( func_num_args() ) { // The hackiest hack that ever did hack |
24 global $current_user, $wp_roles; |
24 global $current_user, $wp_roles; |
25 $user_id = (int) func_get_arg( 0 ); |
25 $user_id = (int) func_get_arg( 0 ); |
26 |
26 |
27 if ( isset( $_POST['role'] ) ) { |
27 if ( isset( $_POST['role'] ) ) { |
|
28 $new_role = sanitize_text_field( $_POST['role'] ); |
28 // Don't let anyone with 'edit_users' (admins) edit their own role to something without it. |
29 // Don't let anyone with 'edit_users' (admins) edit their own role to something without it. |
29 if( $user_id != $current_user->id || $wp_roles->role_objects[$_POST['role']]->has_cap( 'edit_users' ) ) { |
30 if ( $user_id != $current_user->id || $wp_roles->role_objects[$new_role]->has_cap( 'edit_users' ) ) { |
30 // If the new role isn't editable by the logged-in user die with error |
31 // If the new role isn't editable by the logged-in user die with error |
31 $editable_roles = get_editable_roles(); |
32 $editable_roles = get_editable_roles(); |
32 if (!$editable_roles[$_POST['role']]) |
33 if ( !$editable_roles[$new_role] ) |
33 wp_die(__('You can’t give users that role.')); |
34 wp_die(__('You can’t give users that role.')); |
34 |
35 |
35 $user = new WP_User( $user_id ); |
36 $user = new WP_User( $user_id ); |
36 $user->set_role( $_POST['role'] ); |
37 $user->set_role( $new_role ); |
37 } |
38 } |
38 } |
39 } |
39 } else { |
40 } else { |
40 add_action( 'user_register', 'add_user' ); // See above |
41 add_action( 'user_register', 'add_user' ); // See above |
41 return edit_user(); |
42 return edit_user(); |
62 } else { |
63 } else { |
63 $update = false; |
64 $update = false; |
64 $user = ''; |
65 $user = ''; |
65 } |
66 } |
66 |
67 |
67 if ( isset( $_POST['user_login'] )) |
68 if ( !$update && isset( $_POST['user_login'] ) ) |
68 $user->user_login = esc_html( trim( $_POST['user_login'] )); |
69 $user->user_login = sanitize_user($_POST['user_login'], true); |
69 |
70 |
70 $pass1 = $pass2 = ''; |
71 $pass1 = $pass2 = ''; |
71 if ( isset( $_POST['pass1'] )) |
72 if ( isset( $_POST['pass1'] )) |
72 $pass1 = $_POST['pass1']; |
73 $pass1 = $_POST['pass1']; |
73 if ( isset( $_POST['pass2'] )) |
74 if ( isset( $_POST['pass2'] )) |
74 $pass2 = $_POST['pass2']; |
75 $pass2 = $_POST['pass2']; |
75 |
76 |
76 if ( isset( $_POST['role'] ) && current_user_can( 'edit_users' ) ) { |
77 if ( isset( $_POST['role'] ) && current_user_can( 'edit_users' ) ) { |
77 |
78 $new_role = sanitize_text_field( $_POST['role'] ); |
78 // Don't let anyone with 'edit_users' (admins) edit their own role to something without it. |
79 // Don't let anyone with 'edit_users' (admins) edit their own role to something without it. |
79 if( $user_id != $current_user->id || $wp_roles->role_objects[$_POST['role']]->has_cap( 'edit_users' )) |
80 if( $user_id != $current_user->id || $wp_roles->role_objects[$new_role]->has_cap( 'edit_users' )) |
80 $user->role = $_POST['role']; |
81 $user->role = $new_role; |
81 |
82 |
82 // If the new role isn't editable by the logged-in user die with error |
83 // If the new role isn't editable by the logged-in user die with error |
83 $editable_roles = get_editable_roles(); |
84 $editable_roles = get_editable_roles(); |
84 if (!$editable_roles[$_POST['role']]) |
85 if ( !$editable_roles[$new_role] ) |
85 wp_die(__('You can’t give users that role.')); |
86 wp_die(__('You can’t give users that role.')); |
86 } |
87 } |
87 |
88 |
88 if ( isset( $_POST['email'] )) |
89 if ( isset( $_POST['email'] )) |
89 $user->user_email = esc_html( trim( $_POST['email'] )); |
90 $user->user_email = sanitize_text_field( $_POST['email'] ); |
90 if ( isset( $_POST['url'] ) ) { |
91 if ( isset( $_POST['url'] ) ) { |
91 if ( empty ( $_POST['url'] ) || $_POST['url'] == 'http://' ) { |
92 if ( empty ( $_POST['url'] ) || $_POST['url'] == 'http://' ) { |
92 $user->user_url = ''; |
93 $user->user_url = ''; |
93 } else { |
94 } else { |
94 $user->user_url = esc_url( trim( $_POST['url'] )); |
95 $user->user_url = sanitize_url( $_POST['url'] ); |
95 $user->user_url = preg_match('/^(https?|ftps?|mailto|news|irc|gopher|nntp|feed|telnet):/is', $user->user_url) ? $user->user_url : 'http://'.$user->user_url; |
96 $user->user_url = preg_match('/^(https?|ftps?|mailto|news|irc|gopher|nntp|feed|telnet):/is', $user->user_url) ? $user->user_url : 'http://'.$user->user_url; |
96 } |
97 } |
97 } |
98 } |
98 if ( isset( $_POST['first_name'] )) |
99 if ( isset( $_POST['first_name'] ) ) |
99 $user->first_name = esc_html( trim( $_POST['first_name'] )); |
100 $user->first_name = sanitize_text_field( $_POST['first_name'] ); |
100 if ( isset( $_POST['last_name'] )) |
101 if ( isset( $_POST['last_name'] ) ) |
101 $user->last_name = esc_html( trim( $_POST['last_name'] )); |
102 $user->last_name = sanitize_text_field( $_POST['last_name'] ); |
102 if ( isset( $_POST['nickname'] )) |
103 if ( isset( $_POST['nickname'] ) ) |
103 $user->nickname = esc_html( trim( $_POST['nickname'] )); |
104 $user->nickname = sanitize_text_field( $_POST['nickname'] ); |
104 if ( isset( $_POST['display_name'] )) |
105 if ( isset( $_POST['display_name'] ) ) |
105 $user->display_name = esc_html( trim( $_POST['display_name'] )); |
106 $user->display_name = sanitize_text_field( $_POST['display_name'] ); |
106 if ( isset( $_POST['description'] )) |
107 |
|
108 if ( isset( $_POST['description'] ) ) |
107 $user->description = trim( $_POST['description'] ); |
109 $user->description = trim( $_POST['description'] ); |
108 if ( isset( $_POST['jabber'] )) |
110 |
109 $user->jabber = esc_html( trim( $_POST['jabber'] )); |
111 foreach ( _wp_get_user_contactmethods() as $method => $name ) { |
110 if ( isset( $_POST['aim'] )) |
112 if ( isset( $_POST[$method] )) |
111 $user->aim = esc_html( trim( $_POST['aim'] )); |
113 $user->$method = sanitize_text_field( $_POST[$method] ); |
112 if ( isset( $_POST['yim'] )) |
114 } |
113 $user->yim = esc_html( trim( $_POST['yim'] )); |
115 |
114 if ( !$update ) |
116 if ( $update ) { |
115 $user->rich_editing = 'true'; // Default to true for new users. |
117 $user->rich_editing = isset( $_POST['rich_editing'] ) && 'false' == $_POST['rich_editing'] ? 'false' : 'true'; |
116 else if ( isset( $_POST['rich_editing'] ) ) |
118 $user->admin_color = isset( $_POST['admin_color'] ) ? sanitize_text_field( $_POST['admin_color'] ) : 'fresh'; |
117 $user->rich_editing = $_POST['rich_editing']; |
119 } |
118 else |
120 |
119 $user->rich_editing = 'true'; |
121 $user->comment_shortcuts = isset( $_POST['comment_shortcuts'] ) && 'true' == $_POST['comment_shortcuts'] ? 'true' : ''; |
120 |
|
121 $user->comment_shortcuts = isset( $_POST['comment_shortcuts'] )? $_POST['comment_shortcuts'] : ''; |
|
122 |
122 |
123 $user->use_ssl = 0; |
123 $user->use_ssl = 0; |
124 if ( !empty($_POST['use_ssl']) ) |
124 if ( !empty($_POST['use_ssl']) ) |
125 $user->use_ssl = 1; |
125 $user->use_ssl = 1; |
126 |
|
127 if ( !$update ) |
|
128 $user->admin_color = 'fresh'; // Default to fresh for new users. |
|
129 else if ( isset( $_POST['admin_color'] ) ) |
|
130 $user->admin_color = $_POST['admin_color']; |
|
131 else |
|
132 $user->admin_color = 'fresh'; |
|
133 |
126 |
134 $errors = new WP_Error(); |
127 $errors = new WP_Error(); |
135 |
128 |
136 /* checking that username has been typed */ |
129 /* checking that username has been typed */ |
137 if ( $user->user_login == '' ) |
130 if ( $user->user_login == '' ) |
158 |
151 |
159 /* checking the password has been typed twice the same */ |
152 /* checking the password has been typed twice the same */ |
160 if ( $pass1 != $pass2 ) |
153 if ( $pass1 != $pass2 ) |
161 $errors->add( 'pass', __( '<strong>ERROR</strong>: Please enter the same password in the two password fields.' ), array( 'form-field' => 'pass1' ) ); |
154 $errors->add( 'pass', __( '<strong>ERROR</strong>: Please enter the same password in the two password fields.' ), array( 'form-field' => 'pass1' ) ); |
162 |
155 |
163 if (!empty ( $pass1 )) |
156 if ( !empty( $pass1 ) ) |
164 $user->user_pass = $pass1; |
157 $user->user_pass = $pass1; |
165 |
158 |
166 if ( !$update && !validate_username( $user->user_login ) ) |
159 if ( !$update && !validate_username( $user->user_login ) ) |
167 $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is invalid. Please enter a valid username.' )); |
160 $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is invalid. Please enter a valid username.' )); |
168 |
161 |
169 if (!$update && username_exists( $user->user_login )) |
162 if ( !$update && username_exists( $user->user_login ) ) |
170 $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is already registered. Please choose another one.' )); |
163 $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is already registered. Please choose another one.' )); |
171 |
164 |
172 /* checking e-mail address */ |
165 /* checking e-mail address */ |
173 if ( empty ( $user->user_email ) ) { |
166 if ( empty( $user->user_email ) ) { |
174 $errors->add( 'empty_email', __( '<strong>ERROR</strong>: Please enter an e-mail address.' ), array( 'form-field' => 'email' ) ); |
167 $errors->add( 'empty_email', __( '<strong>ERROR</strong>: Please enter an e-mail address.' ), array( 'form-field' => 'email' ) ); |
175 } elseif (!is_email( $user->user_email ) ) { |
168 } elseif ( !is_email( $user->user_email ) ) { |
176 $errors->add( 'invalid_email', __( '<strong>ERROR</strong>: The e-mail address isn’t correct.' ), array( 'form-field' => 'email' ) ); |
169 $errors->add( 'invalid_email', __( '<strong>ERROR</strong>: The e-mail address isn’t correct.' ), array( 'form-field' => 'email' ) ); |
177 } elseif ( ( $owner_id = email_exists($user->user_email) ) && $owner_id != $user->ID ) { |
170 } elseif ( ( $owner_id = email_exists($user->user_email) ) && $owner_id != $user->ID ) { |
178 $errors->add( 'email_exists', __('<strong>ERROR</strong>: This email is already registered, please choose another one.'), array( 'form-field' => 'email' ) ); |
171 $errors->add( 'email_exists', __('<strong>ERROR</strong>: This email is already registered, please choose another one.'), array( 'form-field' => 'email' ) ); |
179 } |
172 } |
180 |
173 |
181 // Allow plugins to return there own errors. |
174 // Allow plugins to return their own errors. |
182 do_action_ref_array('user_profile_update_errors', array ( &$errors, $update, &$user ) ); |
175 do_action_ref_array('user_profile_update_errors', array ( &$errors, $update, &$user ) ); |
183 |
176 |
184 if ( $errors->get_error_codes() ) |
177 if ( $errors->get_error_codes() ) |
185 return $errors; |
178 return $errors; |
186 |
179 |
187 if ( $update ) { |
180 if ( $update ) { |
188 $user_id = wp_update_user( get_object_vars( $user )); |
181 $user_id = wp_update_user( get_object_vars( $user ) ); |
189 } else { |
182 } else { |
190 $user_id = wp_insert_user( get_object_vars( $user )); |
183 $user_id = wp_insert_user( get_object_vars( $user ) ); |
191 wp_new_user_notification( $user_id, isset($_POST['send_password']) ? $pass1 : '' ); |
184 wp_new_user_notification( $user_id, isset($_POST['send_password']) ? $pass1 : '' ); |
192 } |
185 } |
193 return $user_id; |
186 return $user_id; |
194 } |
187 } |
195 |
188 |
369 * @param int $user_id User ID. |
362 * @param int $user_id User ID. |
370 * @return object WP_User object with user data. |
363 * @return object WP_User object with user data. |
371 */ |
364 */ |
372 function get_user_to_edit( $user_id ) { |
365 function get_user_to_edit( $user_id ) { |
373 $user = new WP_User( $user_id ); |
366 $user = new WP_User( $user_id ); |
374 $user->user_login = esc_attr($user->user_login); |
367 |
375 $user->user_email = esc_attr($user->user_email); |
368 $user_contactmethods = _wp_get_user_contactmethods(); |
376 $user->user_url = esc_url($user->user_url); |
369 foreach ($user_contactmethods as $method => $name) { |
377 $user->first_name = esc_attr($user->first_name); |
370 if ( empty( $user->{$method} ) ) |
378 $user->last_name = esc_attr($user->last_name); |
371 $user->{$method} = ''; |
379 $user->display_name = esc_attr($user->display_name); |
372 } |
380 $user->nickname = esc_attr($user->nickname); |
373 |
381 $user->aim = isset( $user->aim ) && !empty( $user->aim ) ? esc_attr($user->aim) : ''; |
374 if ( empty($user->description) ) |
382 $user->yim = isset( $user->yim ) && !empty( $user->yim ) ? esc_attr($user->yim) : ''; |
375 $user->description = ''; |
383 $user->jabber = isset( $user->jabber ) && !empty( $user->jabber ) ? esc_attr($user->jabber) : ''; |
376 |
384 $user->description = isset( $user->description ) && !empty( $user->description ) ? esc_html($user->description) : ''; |
377 $user = sanitize_user_object($user, 'edit'); |
385 |
378 |
386 return $user; |
379 return $user; |
387 } |
380 } |
388 |
381 |
389 /** |
382 /** |