Changeset 2792

Timestamp:

03/24/2016 07:08:17 PM (10 years ago)

Author:

obenland

Message:

Plugin Directory: Prevent Committers from accessing certain admin pages.

This can be extended as needed.

See #1571.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-customizations.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-customizations.php

@@ -43 +43 @@
                 add_filter( 'wp_ajax_add-committer',    array( __NAMESPACE__ . '\Metabox\Committers', 'add_committer'    ) );
                 add_filter( 'wp_ajax_delete-committer', array( __NAMESPACE__ . '\Metabox\Committers', 'remove_committer' ) );
+
+                // Page access within wp-admin.
                 add_action( 'admin_menu', array( $this, 'admin_menu' ) );
-
+                add_action( 'load-index.php',    array( $this, 'disable_admin_page' ) );
+                add_action( 'load-profile.php',  array( $this, 'disable_admin_page' ) );
         }
 
@@ -89 +92 @@
         }
 
+        /**
+         * Customizes the admin menu according to the current user's privileges.
+         */
         public function admin_menu() {
-                // WordPress requires that the plugin post_type have at least one submenu accessible *other* than itself.
-                // If it doesn't have at least one submenu then users who cannot also publish posts will not be able to access the post type.
+
+                /*
+                 * WordPress requires that the plugin post_type have at least one submenu accessible *other* than itself.
+                 * If it doesn't have at least one submenu then users who cannot also publish posts will not be able to access the post type.
+                 */
                 add_submenu_page( 'edit.php?post_type=plugin', 'Plugin Handbook', 'Plugin Handbook', 'read', 'handbook', function() {} );
                 add_submenu_page( 'edit.php?post_type=plugin', 'Readme Validator', 'Readme Validator', 'read', 'readme_validator', function() {} );
 
-                remove_menu_page( 'index.php' );
-                remove_menu_page( 'profile.php' );
+                if ( ! current_user_can( 'manage_options' ) ) {
+                        remove_menu_page( 'index.php' );
+                        remove_menu_page( 'profile.php' );
+                }
+        }
+
+        /**
+         * Disables admin pages.
+         */
+        public function disable_admin_page() {
+                if ( ! current_user_can( 'manage_options' ) ) {
+
+                        // Dashboard is plugin dashboard.
+                        if ( 'load-index.php' === current_action() ) {
+                                wp_safe_redirect( admin_url( 'edit.php?post_type=plugin' ) );
+                                exit;
+                        }
+
+                        wp_die( __( 'You do not have permission to access this page.', 'wporg-plugins' ), '', array(
+                                'back_link' => true,
+                        ) );
+                }
         }