Skip to content
This repository has been archived by the owner on Sep 27, 2022. It is now read-only.

Commit

Permalink
Bug fix: Roles with no capabilities set were not being processed. Che…
Browse files Browse the repository at this point in the history
…ck the nonce field for verification that the form was posted instead.
  • Loading branch information
Justin Tadlock committed Oct 10, 2015
1 parent cd968b1 commit 71e03dd
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions admin/class-role-edit.php
Expand Up @@ -112,17 +112,19 @@ public function load() {
$this->is_editable = members_is_role_editable( $this->role->name );

// Check if the form has been submitted.
if ( $this->is_editable && ( isset( $_POST['grant-caps'] ) || isset( $_POST['deny-caps'] ) || isset( $_POST['grant-new-caps'] ) || isset( $_POST['deny-new-caps'] ) ) ) {
if ( $this->is_editable && isset( $_POST['members_edit_role_nonce'] ) ) {

// Verify the nonce.
check_admin_referer( 'edit_role', 'members_edit_role_nonce' );

// Get the granted and denied caps.
$grant_caps = ! empty( $_POST['grant-caps'] ) ? array_unique( $_POST['grant-caps'] ) : array();
$deny_caps = ! empty( $_POST['deny-caps'] ) ? array_unique( $_POST['deny-caps'] ) : array();

// Get the new (custom) granted and denied caps.
$grant_new_caps = ! empty( $_POST['grant-new-caps'] ) ? array_unique( $_POST['grant-new-caps'] ) : array();
$deny_new_caps = ! empty( $_POST['deny-new-caps'] ) ? array_unique( $_POST['deny-new-caps'] ) : array();

// Verify the nonce.
check_admin_referer( 'edit_role', 'members_edit_role_nonce' );

// Set the $role_updated variable to true.
$this->role_updated = true;

Expand Down

0 comments on commit 71e03dd

Please sign in to comment.