<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[41290] trunk: Plugins: Introduce singular capabilities for activating and deactivating individual plugins.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/41290">41290</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/41290","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>johnbillion</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2017-08-22 14:01:36 +0000 (Tue, 22 Aug 2017)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Plugins: Introduce singular capabilities for activating and deactivating individual plugins.
This introduces the following meta capabilities:
* `activate_plugin`
* `deactivate_plugin`
* `deactivate_plugins`
The singular `activate_plugin` and `deactivate_plugin` capabilities are used along with the corresponding plugin name when
determining whether or not a user can activate or deactivate an individual plugin.
The plural `deactivate_plugins` capability is used in place of the existing `activate_plugins` capability when determining
whether a user can deactivate plugins.
Each of these new meta capabilities map to the existing `activate_plugins` primitive capability, which means there is no
change in existing behaviour, but plugins can now filter the capabilities required to activate and deactivate individual
plugins.
Fixes <a href="https://core.trac.wordpress.org/ticket/38652">#38652</a> </pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpadminincludesajaxactionsphp">trunk/src/wp-admin/includes/ajax-actions.php</a></li>
<li><a href="#trunksrcwpadminincludesclassplugininstallerskinphp">trunk/src/wp-admin/includes/class-plugin-installer-skin.php</a></li>
<li><a href="#trunksrcwpadminincludesclasspluginupgraderskinphp">trunk/src/wp-admin/includes/class-plugin-upgrader-skin.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswpplugininstalllisttablephp">trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswppluginslisttablephp">trunk/src/wp-admin/includes/class-wp-plugins-list-table.php</a></li>
<li><a href="#trunksrcwpadminpluginsphp">trunk/src/wp-admin/plugins.php</a></li>
<li><a href="#trunksrcwpincludescapabilitiesphp">trunk/src/wp-includes/capabilities.php</a></li>
<li><a href="#trunktestsphpunittestsusercapabilitiesphp">trunk/tests/phpunit/tests/user/capabilities.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpadminincludesajaxactionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/ajax-actions.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/ajax-actions.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/src/wp-admin/includes/ajax-actions.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3704,7 +3704,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // If installation request is coming from import page, do not return network activation link.
</span><span class="cx" style="display: block; padding: 0 10px"> $plugins_url = ( 'import' === $pagenow ) ? admin_url( 'plugins.php' ) : network_admin_url( 'plugins.php' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( current_user_can( 'activate_plugins' ) && is_plugin_inactive( $install_status['file'] ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( current_user_can( 'activate_plugin', $install_status['file'] ) && is_plugin_inactive( $install_status['file'] ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $status['activateUrl'] = add_query_arg( array(
</span><span class="cx" style="display: block; padding: 0 10px"> '_wpnonce' => wp_create_nonce( 'activate-plugin_' . $install_status['file'] ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'action' => 'activate',
</span></span></pre></div>
<a id="trunksrcwpadminincludesclassplugininstallerskinphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-plugin-installer-skin.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-plugin-installer-skin.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/src/wp-admin/includes/class-plugin-installer-skin.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -71,7 +71,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! $this->result || is_wp_error($this->result) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> unset( $install_actions['activate_plugin'], $install_actions['network_activate'] );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- } elseif ( ! current_user_can( 'activate_plugins' ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ } elseif ( ! current_user_can( 'activate_plugin', $plugin_file ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> unset( $install_actions['activate_plugin'] );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasspluginupgraderskinphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-plugin-upgrader-skin.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-plugin-upgrader-skin.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/src/wp-admin/includes/class-plugin-upgrader-skin.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -51,7 +51,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'activate_plugin' => '<a href="' . wp_nonce_url( 'plugins.php?action=activate&plugin=' . urlencode( $this->plugin ), 'activate-plugin_' . $this->plugin) . '" target="_parent">' . __( 'Activate Plugin' ) . '</a>',
</span><span class="cx" style="display: block; padding: 0 10px"> 'plugins_page' => '<a href="' . self_admin_url( 'plugins.php' ) . '" target="_parent">' . __( 'Return to Plugins page' ) . '</a>'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( $this->plugin_active || ! $this->result || is_wp_error( $this->result ) || ! current_user_can( 'activate_plugins' ) )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( $this->plugin_active || ! $this->result || is_wp_error( $this->result ) || ! current_user_can( 'activate_plugin', $this->plugin ) )
</ins><span class="cx" style="display: block; padding: 0 10px"> unset( $update_actions['activate_plugin'] );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswpplugininstalllisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -468,7 +468,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> case 'newer_installed':
</span><span class="cx" style="display: block; padding: 0 10px"> if ( is_plugin_active( $status['file'] ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $action_links[] = '<button type="button" class="button button-disabled" disabled="disabled">' . _x( 'Active', 'plugin' ) . '</button>';
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- } elseif ( current_user_can( 'activate_plugins' ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ } elseif ( current_user_can( 'activate_plugin', $status['file'] ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $button_text = __( 'Activate' );
</span><span class="cx" style="display: block; padding: 0 10px"> /* translators: %s: Plugin name */
</span><span class="cx" style="display: block; padding: 0 10px"> $button_label = _x( 'Activate %s', 'plugin' );
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswppluginslisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-plugins-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-plugins-list-table.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/src/wp-admin/includes/class-wp-plugins-list-table.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -620,11 +620,15 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'network_only' => __( 'Network Only' ),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> } elseif ( $is_active ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- /* translators: %s: plugin name */
- $actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&plugin=' . $plugin_file . '&plugin_status=' . $context . '&paged=' . $page . '&s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Deactivate %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Deactivate' ) . '</a>';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( current_user_can( 'deactivate_plugin', $plugin_file ) ) {
+ /* translators: %s: plugin name */
+ $actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&plugin=' . $plugin_file . '&plugin_status=' . $context . '&paged=' . $page . '&s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Deactivate %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Deactivate' ) . '</a>';
+ }
</ins><span class="cx" style="display: block; padding: 0 10px"> } else {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- /* translators: %s: plugin name */
- $actions['activate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=activate&plugin=' . $plugin_file . '&plugin_status=' . $context . '&paged=' . $page . '&s=' . $s, 'activate-plugin_' . $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( _x( 'Activate %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Activate' ) . '</a>';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( current_user_can( 'activate_plugin', $plugin_file ) ) {
+ /* translators: %s: plugin name */
+ $actions['activate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=activate&plugin=' . $plugin_file . '&plugin_status=' . $context . '&paged=' . $page . '&s=' . $s, 'activate-plugin_' . $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( _x( 'Activate %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Activate' ) . '</a>';
+ }
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! is_multisite() && current_user_can( 'delete_plugins' ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> /* translators: %s: plugin name */
</span></span></pre></div>
<a id="trunksrcwpadminpluginsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/plugins.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/plugins.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/src/wp-admin/plugins.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -29,8 +29,9 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> switch ( $action ) {
</span><span class="cx" style="display: block; padding: 0 10px"> case 'activate':
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! current_user_can('activate_plugins') )
- wp_die(__('Sorry, you are not allowed to activate plugins for this site.'));
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( ! current_user_can( 'activate_plugin', $plugin ) ) {
+ wp_die( __( 'Sorry, you are not allowed to activate this plugin.' ) );
+ }
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( is_multisite() && ! is_network_admin() && is_network_only_plugin( $plugin ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> wp_redirect( self_admin_url("plugins.php?plugin_status=$status&paged=$page&s=$s") );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -88,6 +89,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( is_plugin_active( $plugin ) || ( is_multisite() && is_network_only_plugin( $plugin ) ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> unset( $plugins[ $i ] );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ // Only activate plugins which the user can activate.
+ if ( ! current_user_can( 'activate_plugin', $plugin ) ) {
+ unset( $plugins[ $i ] );
+ }
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -146,8 +151,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> exit;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> case 'error_scrape':
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! current_user_can('activate_plugins') )
- wp_die(__('Sorry, you are not allowed to activate plugins for this site.'));
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( ! current_user_can( 'activate_plugin', $plugin ) ) {
+ wp_die( __( 'Sorry, you are not allowed to activate this plugin.' ) );
+ }
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer('plugin-activation-error_' . $plugin);
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -167,8 +173,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> exit;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> case 'deactivate':
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! current_user_can('activate_plugins') )
- wp_die(__('Sorry, you are not allowed to deactivate plugins for this site.'));
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( ! current_user_can( 'deactivate_plugin', $plugin ) ) {
+ wp_die( __( 'Sorry, you are not allowed to deactivate this plugin.' ) );
+ }
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer('deactivate-plugin_' . $plugin);
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -192,8 +199,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> exit;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> case 'deactivate-selected':
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! current_user_can('activate_plugins') )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( ! current_user_can( 'deactivate_plugins' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_die(__('Sorry, you are not allowed to deactivate plugins for this site.'));
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ }
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer('bulk-plugins');
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -204,6 +212,14 @@
</span><span class="cx" style="display: block; padding: 0 10px"> } else {
</span><span class="cx" style="display: block; padding: 0 10px"> $plugins = array_filter( $plugins, 'is_plugin_active' );
</span><span class="cx" style="display: block; padding: 0 10px"> $plugins = array_diff( $plugins, array_filter( $plugins, 'is_plugin_active_for_network' ) );
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
+ foreach ( $plugins as $i => $plugin ) {
+ // Only deactivate plugins which the user can deactivate.
+ if ( ! current_user_can( 'deactivate_plugin', $plugin ) ) {
+ unset( $plugins[ $i ] );
+ }
+ }
+
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> if ( empty($plugins) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> wp_redirect( self_admin_url("plugins.php?plugin_status=$status&paged=$page&s=$s") );
</span></span></pre></div>
<a id="trunksrcwpincludescapabilitiesphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/capabilities.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/capabilities.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/src/wp-includes/capabilities.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -407,7 +407,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> break;
</span><span class="cx" style="display: block; padding: 0 10px"> case 'activate_plugins':
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $caps[] = $cap;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ case 'deactivate_plugins':
+ case 'activate_plugin':
+ case 'deactivate_plugin':
+ $caps[] = 'activate_plugins';
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( is_multisite() ) {
</span><span class="cx" style="display: block; padding: 0 10px"> // update_, install_, and delete_ are handled above with is_super_admin().
</span><span class="cx" style="display: block; padding: 0 10px"> $menu_perms = get_site_option( 'menu_items', array() );
</span></span></pre></div>
<a id="trunktestsphpunittestsusercapabilitiesphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/tests/phpunit/tests/user/capabilities.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/tests/phpunit/tests/user/capabilities.php 2017-08-22 11:51:11 UTC (rev 41289)
+++ trunk/tests/phpunit/tests/user/capabilities.php 2017-08-22 14:01:36 UTC (rev 41290)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -235,6 +235,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'add_users' => array( 'administrator' ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'install_languages' => array( 'administrator' ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'update_languages' => array( 'administrator' ),
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'deactivate_plugins' => array( 'administrator' ),
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> 'edit_categories' => array( 'administrator', 'editor' ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'delete_categories' => array( 'administrator', 'editor' ),
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -265,6 +266,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'upgrade_network' => array(),
</span><span class="cx" style="display: block; padding: 0 10px"> 'install_languages' => array(),
</span><span class="cx" style="display: block; padding: 0 10px"> 'update_languages' => array(),
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'deactivate_plugins' => array(),
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> 'customize' => array( 'administrator' ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'delete_site' => array( 'administrator' ),
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -425,6 +427,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $expected['create_users'],
</span><span class="cx" style="display: block; padding: 0 10px"> $expected['manage_links'],
</span><span class="cx" style="display: block; padding: 0 10px"> // Singular object meta capabilities (where an object ID is passed) are not tested:
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $expected['activate_plugin'],
+ $expected['deactivate_plugin'],
</ins><span class="cx" style="display: block; padding: 0 10px"> $expected['remove_user'],
</span><span class="cx" style="display: block; padding: 0 10px"> $expected['promote_user'],
</span><span class="cx" style="display: block; padding: 0 10px"> $expected['edit_user'],
</span></span></pre>
</div>
</div>
</body>
</html>