merge wp-admin user, plugins, themes, upgrade , See #11644

git-svn-id: http://svn.automattic.com/wordpress/trunk@12722 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-admin/plugins.php

@@ -231,8 +231,10 @@ wp_enqueue_script('plugin-install');
 add_thickbox();
 
 $help = '<p>' . __('Plugins extend and expand the functionality of WordPress. Once a plugin is installed, you may activate it or deactivate it here.') . '</p>';
+if ( !is_multisite() || is_super_admin() ) {
 $help .= '<p>' . sprintf(__('If something goes wrong with a plugin and you can&#8217;t use WordPress, delete or rename that file in the <code>%s</code> directory and it will be automatically deactivated.'), WP_PLUGIN_DIR) . '</p>';
 $help .= '<p>' . sprintf(__('You can find additional plugins for your site by using the new <a href="%1$s">Plugin Browser/Installer</a> functionality or by browsing the <a href="http://wordpress.org/extend/plugins/">WordPress Plugin Directory</a> directly and installing manually.  To <em>manually</em> install a plugin you generally just need to upload the plugin file into your <code>%2$s</code> directory.  Once a plugin has been installed, you may activate it here.'), 'plugin-install.php', WP_PLUGIN_DIR) . '</p>';
+}
 
 add_contextual_help('plugins', $help);
 
@@ -282,11 +284,11 @@ if ( !empty($invalid) )
 
 <div class="wrap">
 <?php screen_icon(); ?>
-<h2><?php echo esc_html( $title ); ?> <a href="plugin-install.php" class="button add-new-h2"><?php echo esc_html_x('Add New', 'plugin'); ?></a></h2>
+<h2><?php echo esc_html( $title ); if ( !is_multisite() || is_super_admin() ) { ?> <a href="plugin-install.php" class="button add-new-h2"><?php echo esc_html_x('Add New', 'plugin'); ?></a><?php } ?></h2>
 
 <?php
 
-$all_plugins = get_plugins();
+$all_plugins = apply_filters( 'all_plugins', get_plugins() );
 $search_plugins = array();
 $active_plugins = array();
 $inactive_plugins = array();
@@ -323,6 +325,10 @@ foreach ( (array)$all_plugins as $plugin_file => $plugin_data) {
         $upgrade_plugins[ $plugin_file ] = $plugin_data;
 }
 
+if ( is_multisite() && !is_super_admin() ) {
+	$upgrade_plugins = false;
+}
+
 $total_all_plugins = count($all_plugins);
 $total_inactive_plugins = count($inactive_plugins);
 $total_active_plugins = count($active_plugins);
@@ -515,6 +521,8 @@ function print_plugin_actions($context, $field_name = 'action' ) {
 </p>
 </form>
 
+<?php do_action( 'pre_current_active_plugins', $all_plugins ) ?>
+
 <form method="post" action="<?php echo admin_url('plugins.php') ?>">
 <?php wp_nonce_field('bulk-manage-plugins') ?>
 <input type="hidden" name="plugin_status" value="<?php echo esc_attr($status) ?>" />

wp-admin/themes.php

@@ -12,6 +12,30 @@ require_once('admin.php');
 if ( !current_user_can('switch_themes') )
 	wp_die( __( 'Cheatin’ uh?' ) );
 
+if ( is_multisite() ) {
+	$themes = get_themes();
+	$ct = current_theme_info();
+	$allowed_themes = apply_filters("allowed_themes", get_site_allowed_themes() ); 
+	if( $allowed_themes == false )
+		$allowed_themes = array();
+
+	$blog_allowed_themes = wpmu_get_blog_allowedthemes();
+	if( is_array( $blog_allowed_themes ) )
+		$allowed_themes = array_merge( $allowed_themes, $blog_allowed_themes );
+	if( $blog_id != 1 )
+		unset( $allowed_themes[ "h3" ] );
+
+	if( isset( $allowed_themes[ wp_specialchars( $ct->stylesheet ) ] ) == false )
+		$allowed_themes[ wp_specialchars( $ct->stylesheet ) ] = true;
+
+	reset( $themes );
+	foreach( $themes as $key => $theme ) {
+		if( isset( $allowed_themes[ wp_specialchars( $theme[ 'Stylesheet' ] ) ] ) == false ) {
+			unset( $themes[ $key ] );
+		}
+	}
+	reset( $themes );
+}
 if ( isset($_GET['action']) ) {
 	if ( 'activate' == $_GET['action'] ) {
 		check_admin_referer('switch-theme_' . $_GET['template']);
@@ -32,7 +56,7 @@ $title = __('Manage Themes');
 $parent_file = 'themes.php';
 
 $help = '<p>' . __('Themes give your WordPress style. Once a theme is installed, you may preview it, activate it or deactivate it here.') . '</p>';
-if ( current_user_can('install_themes') ) {
+if ( ( !is_multisite() && current_user_can('install_themes') ) || is_super_admin() ) {
 	$help .= '<p>' . sprintf(__('You can find additional themes for your site by using the new <a href="%1$s">Theme Browser/Installer</a> functionality or by browsing the <a href="http://wordpress.org/extend/themes/">WordPress Theme Directory</a> directly and installing manually.  To install a theme <em>manually</em>, <a href="%2$s">upload its ZIP archive with the new uploader</a> or copy its folder via FTP into your <code>wp-content/themes</code> directory.'), 'theme-install.php', 'theme-install.php?tab=upload' ) . '</p>';
 	$help .= '<p>' . __('Once a theme is uploaded, you should see it on this page.') . '</p>' ;
 }
@@ -43,6 +67,9 @@ add_thickbox();
 wp_enqueue_script( 'theme-preview' );
 
 require_once('admin-header.php');
+if( is_multisite() && is_super_admin() ) {
+	?><div id="message0" class="updated fade"><p><?php _e('Administrator: new themes must be activated in the <a href="wpmu-themes.php">Themes Admin</a> page before they appear here.'); ?></p></div><?php
+}
 ?>
 
 <?php if ( ! validate_current_theme() ) : ?>
@@ -58,7 +85,8 @@ require_once('admin-header.php');
 <?php endif; ?>
 
 <?php
-$themes = get_themes();
+if ( !is_multisite() )
+	$themes = get_themes();
 $ct = current_theme_info();
 unset($themes[$ct->name]);
 
@@ -97,6 +125,10 @@ $themes = array_slice( $themes, $start, $per_page );
  */
 function theme_update_available( $theme ) {
 	static $themes_update;
+
+	if ( is_multisite() && !is_super_admin() )
+		return;
+
 	if ( !isset($themes_update) )
 		$themes_update = get_site_transient('update_themes');
 
@@ -127,7 +159,7 @@ function theme_update_available( $theme ) {
 
 <div class="wrap">
 <?php screen_icon(); ?>
-<h2><?php echo esc_html( $title ); ?> <a href="theme-install.php" class="button add-new-h2"><?php echo esc_html_x('Add New', 'theme'); ?></a></h2>
+<h2><?php echo esc_html( $title ); if ( !is_multisite() || is_super_admin() ) { ?> <a href="theme-install.php" class="button add-new-h2"><?php echo esc_html_x('Add New', 'theme'); ?></a><?php } ?></h2>
 
 <h3><?php _e('Current Theme'); ?></h3>
 <div id="current-theme">
@@ -138,7 +170,7 @@ function theme_update_available( $theme ) {
 	/* translators: 1: theme title, 2: theme version, 3: theme author */
 	printf(__('%1$s %2$s by %3$s'), $ct->title, $ct->version, $ct->author) ; ?></h4>
 <p class="theme-description"><?php echo $ct->description; ?></p>
-<?php if ($ct->parent_theme) { ?>
+<?php if ( ( !is_multisite() || is_super_admin() ) && $ct->parent_theme ) { ?>
 	<p><?php printf(__('The template files are located in <code>%2$s</code>.  The stylesheet files are located in <code>%3$s</code>.  <strong>%4$s</strong> uses templates from <strong>%5$s</strong>.  Changes made to the templates will affect both themes.'), $ct->title, str_replace( WP_CONTENT_DIR, '', $ct->template_dir ), str_replace( WP_CONTENT_DIR, '', $ct->stylesheet_dir ), $ct->title, $ct->parent_theme); ?></p>
 <?php } else { ?>
 	<p><?php printf(__('All of this theme&#8217;s files are located in <code>%2$s</code>.'), $ct->title, str_replace( WP_CONTENT_DIR, '', $ct->template_dir ), str_replace( WP_CONTENT_DIR, '', $ct->stylesheet_dir ) ); ?></p>
@@ -217,7 +249,7 @@ foreach ( $cols as $col => $theme_name ) {
 	$actions = array();
 	$actions[] = '<a href="' . $activate_link .  '" class="activatelink" title="' . $activate_text . '">' . __('Activate') . '</a>';
 	$actions[] = '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $theme_name)) . '">' . __('Preview') . '</a>';
-	if ( current_user_can('update_themes') )
+	if ( ( !is_multisite() && current_user_can('update_themes') ) || is_super_admin() )
 		$actions[] = '<a class="submitdelete deletion" href="' . wp_nonce_url("themes.php?action=delete&amp;template=$stylesheet", 'delete-theme_' . $stylesheet) . '" onclick="' . "if ( confirm('" . esc_js(sprintf( __("You are about to delete this theme '%s'\n  'Cancel' to stop, 'OK' to delete."), $theme_name )) . "') ) {return true;}return false;" . '">' . __('Delete') . '</a>';
 	$actions = apply_filters('theme_action_links', $actions, $themes[$theme_name]);
 
@@ -233,7 +265,7 @@ foreach ( $cols as $col => $theme_name ) {
 	printf(__('%1$s %2$s by %3$s'), $title, $version, $author) ; ?></h3>
 <p class="description"><?php echo $description; ?></p>
 <span class='action-links'><?php echo $actions ?></span>
-	<?php if ($parent_theme) {
+	<?php if ( ( !is_multisite() || is_super_admin() ) && $parent_theme ) {
 	/* translators: 1: theme title, 2:  template dir, 3: stylesheet_dir, 4: theme title, 5: parent_theme */ ?>
 	<p><?php printf(__('The template files are located in <code>%2$s</code>.  The stylesheet files are located in <code>%3$s</code>.  <strong>%4$s</strong> uses templates from <strong>%5$s</strong>.  Changes made to the templates will affect both themes.'), $title, str_replace( WP_CONTENT_DIR, '', $template_dir ), str_replace( WP_CONTENT_DIR, '', $stylesheet_dir ), $title, $parent_theme); ?></p>
 <?php } else { ?>
@@ -266,10 +298,10 @@ foreach ( $cols as $col => $theme_name ) {
 <?php
 // List broken themes, if any.
 $broken_themes = get_broken_themes();
-if ( count($broken_themes) ) {
+if ( ( !is_multisite() || is_super_admin() ) && count( $broken_themes ) ) {
 ?>
 
-<h2><?php _e('Broken Themes'); ?></h2>
+<h2><?php _e('Broken Themes'); ?> <?php if ( is_multisite() ) _e( '(Site admin only)' ); ?></h2>
 <p><?php _e('The following themes are installed but incomplete.  Themes must have a stylesheet and a template.'); ?></p>
 
 <table id="broken-themes">

wp-admin/upgrade.php

@@ -86,6 +86,11 @@ switch ( $step ) :
 			$backto = stripslashes( urldecode( $backto ) );
 			$backto = esc_url_raw( $backto  );
 			$backto = wp_validate_redirect($backto, __get_option( 'home' ) . '/');
+		if( $wpdb->get_row( "SELECT blog_id FROM {$wpdb->blog_versions} WHERE blog_id = '{$wpdb->blogid}'" ) ) {
+			$wpdb->query( "UPDATE {$wpdb->blog_versions} SET db_version = '{$wp_db_version}' WHERE blog_id = '{$wpdb->blogid}'" );
+		} else {
+			$wpdb->query( "INSERT INTO {$wpdb->blog_versions} ( `blog_id` , `db_version` , `last_updated` ) VALUES ( '{$wpdb->blogid}', '{$wp_db_version}', NOW());" );
+		}
 ?>
 <h2><?php _e( 'Upgrade Complete' ); ?></h2>
 	<p><?php _e( 'Your WordPress database has been successfully upgraded!' ); ?></p>

wp-admin/user-edit.php

@@ -60,6 +60,11 @@ function use_ssl_preference($user) {
 <?php
 }
 
+
+// Only allow site admins to edit every user. 
+if ( is_multisite() && !defined( "EDIT_ANY_USER" ) && !is_super_admin() && $user_id != $current_user->ID ) 
+	wp_die( __( 'You do not have permission to edit this user.' ) ); 
+	
 switch ($action) {
 case 'switchposts':
 
@@ -81,7 +86,24 @@ if ( IS_PROFILE_PAGE )
 else
 	do_action('edit_user_profile_update', $user_id);
 
-$errors = edit_user($user_id);
+if ( !is_multisite() ) {
+	$errors = edit_user($user_id);
+} else {
+	// WPMU must delete the user from the current blog if WP added him after editing.
+	$delete_role = false;
+	$blog_prefix = $wpdb->get_blog_prefix();
+	if( $user_id != $current_user->ID ) {
+		$cap = $wpdb->get_var( "SELECT meta_value FROM {$wpdb->usermeta} WHERE user_id = '{$user_id}' AND meta_key = '{$blog_prefix}capabilities' AND meta_value = 'a:0:{}'" );
+		if( null == $cap && $_POST[ 'role' ] == '' ) {
+			$_POST[ 'role' ] = 'contributor';
+			$delete_role = true;
+		}
+	}
+	if ( !isset( $errors ) || ( isset( $errors ) && is_object( $errors ) && false == $errors->get_error_codes() ) )
+		$errors = edit_user($user_id);
+	if( $delete_role ) // stops users being added to current blog when they are edited
+		update_usermeta( $user_id, $blog_prefix . 'capabilities' , '' );
+}
 
 if ( !is_wp_error( $errors ) ) {
 	$redirect = (IS_PROFILE_PAGE ? "profile.php?" : "user-edit.php?user_id=$user_id&"). "updated=true";

wp-admin/user-new.php

@@ -15,12 +15,31 @@ if ( !current_user_can('create_users') )
 /** WordPress Registration API */
 require_once( ABSPATH . WPINC . '/registration.php');
 
+if ( is_multisite() ) {
+	function admin_created_user_email( $text ) {
+		return sprintf( __( "Hi,
+You've been invited to join '%s' at
+%s as a %s.
+If you do not want to join this blog please ignore
+this email. This invitation will expire in a few days.
+
+Please click the following link to activate your user account:
+%%s" ), get_bloginfo('name'), site_url(), wp_specialchars( $_REQUEST[ 'role' ] ) );
+	}
+	add_filter( 'wpmu_signup_user_notification_email', 'admin_created_user_email' );
+
+	function admin_created_user_subject( $text ) {
+		return "[" . get_bloginfo('name') . "] Your blog invite";
+	}
+}
+
 if ( isset($_REQUEST['action']) && 'adduser' == $_REQUEST['action'] ) {
 	check_admin_referer('add-user');
 
 	if ( ! current_user_can('create_users') )
 		wp_die(__('You can’t create users.'));
 
+	if ( !is_multisite() ) {
 		$user_id = add_user();
 
 		if ( is_wp_error( $user_id ) ) {
@@ -31,6 +50,55 @@ if ( isset($_REQUEST['action']) && 'adduser' == $_REQUEST['action'] ) {
 			wp_redirect( $redirect . '#user-' . $user_id );
 			die();
 		}
+	} else {
+		$user_login = preg_replace( "/\s+/", '', sanitize_user( $_REQUEST[ 'user_login' ], true ) );
+		$user_details = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->users} WHERE user_login = %s AND user_email = %s", $user_login, $_REQUEST[ 'email' ] ) );
+		if( $user_details ) {
+			// Adding an existing user to this blog
+			$new_user_email = wp_specialchars(trim($_REQUEST['email']));
+			$redirect = 'user-new.php';
+			$username = $user_details->user_login;
+			$user_id = $user_details->ID;
+			if( ($username != null && is_site_admin( $username ) == false ) && ( array_key_exists($blog_id, get_blogs_of_user($user_id)) ) ) {
+				$redirect = add_query_arg( array('update' => 'addexisting'), 'user-new.php' );
+			} else {
+				if ( isset( $_POST[ 'noconfirmation' ] ) && is_site_admin() ) {
+					add_existing_user_to_blog( array( 'user_id' => $user_id, 'role' => $_REQUEST[ 'role' ] ) );
+					$redirect = add_query_arg( array('update' => 'addnoconfirmation'), 'user-new.php' );
+				} else {
+					$newuser_key = substr( md5( $user_id ), 0, 5 );
+					add_option( 'new_user_' . $newuser_key, array( 'user_id' => $user_id, 'email' => $user_details->user_email, 'role' => $_REQUEST[ 'role' ] ) );
+					$message = __("Hi,\n\nYou have been invited to join '%s' at\n%s as a %s.\nPlease click the following link to confirm the invite:\n%s\n");
+					wp_mail( $new_user_email, sprintf( __( '[%s] Joining confirmation' ), get_option( 'blogname' ) ),  sprintf($message, get_option('blogname'), site_url(), $_REQUEST[ 'role' ], site_url("/newbloguser/$newuser_key/")));
+					$redirect = add_query_arg( array('update' => 'add'), 'user-new.php' );
+				}
+			}
+			wp_redirect( $redirect );
+			die();
+		} else {
+			// Adding a new user to this blog
+			$user_details = wpmu_validate_user_signup( $_REQUEST[ 'user_login' ], $_REQUEST[ 'email' ] );
+			unset( $user_details[ 'errors' ]->errors[ 'user_email_used' ] );
+			if ( is_wp_error( $user_details[ 'errors' ] ) && !empty( $user_details[ 'errors' ]->errors ) ) {
+				$add_user_errors = $user_details[ 'errors' ];
+			} else {
+				$new_user_login = apply_filters('pre_user_login', sanitize_user(stripslashes($_REQUEST['user_login']), true));
+				if ( isset( $_POST[ 'noconfirmation' ] ) && is_site_admin() ) {
+					add_filter( 'wpmu_signup_user_notification', create_function('', '{return false;}') ); // Disable confirmation email
+				}
+				wpmu_signup_user( $new_user_login, $_REQUEST[ 'email' ], array( 'add_to_blog' => $wpdb->blogid, 'new_role' => $_REQUEST[ 'role' ] ) );
+				if ( isset( $_POST[ 'noconfirmation' ] ) && is_site_admin() ) {
+					$key = $wpdb->get_var( $wpdb->prepare( "SELECT activation_key FROM {$wpdb->signups} WHERE user_login = %s AND user_email = %s", $new_user_login, $_REQUEST[ 'email' ] ) );
+					wpmu_activate_signup( $key );
+					$redirect = add_query_arg( array('update' => 'addnoconfirmation'), 'user-new.php' );
+				} else {
+					$redirect = add_query_arg( array('update' => 'newuserconfimation'), 'user-new.php' );
+				}
+				wp_redirect( $redirect );
+				die();
+			}
+		}
+	}
 }
 
 $title = __('Add New User');
@@ -42,6 +110,22 @@ wp_enqueue_script('password-strength-meter');
 
 require_once ('admin-header.php');
 
+if ( is_multisite() ) {
+	switch( $_GET[ 'update' ] ) {
+		case "newuserconfimation":
+			$messages[] = '<div id="message" class="updated fade"><p>' . __('Invitation email sent to new user. A confirmation link must be clicked before their account is created.') . '</p></div>';
+			break;
+		case "add":
+			$messages[] = '<div id="message" class="updated fade"><p>' . __('Invitation email sent to user. A confirmation link must be clicked for them to be added to your blog.') . '</p></div>';
+			break;
+		case "addnoconfirmation":
+			$messages[] = '<div id="message" class="updated fade"><p>' . __('User has been added to your blog.') . '</p></div>';
+			break;
+		case "addexisting":
+			$messages[] = '<div id="message" class="updated fade"><p>' . __('That user is already a member of this blog.') . '</p></div>';
+			break;
+	}
+}
 ?>
 <div class="wrap">
 <?php screen_icon(); ?>
@@ -74,10 +158,15 @@ if ( ! empty($messages) ) {
 <div id="ajax-response"></div>
 
 <?php
+if ( !is_multisite() ) {
 	if ( get_option('users_can_register') )
 		echo '<p>' . sprintf(__('Users can <a href="%1$s">register themselves</a> or you can manually create users here.'), site_url('wp-register.php')) . '</p>';
 	else
 		echo '<p>' . sprintf(__('Users cannot currently <a href="%1$s">register themselves</a>, but you can manually create users here.'), admin_url('options-general.php#users_can_register')) . '</p>';
+} else {
+	echo '<p>' . __( 'You can add new users to your blog in two ways:' ) . '<ol><li> ' . __( 'Enter the username and email address of an existing user on this site.' ) . '</li><li> ' . __( 'Enter the username and the email address of a person who is not already a member of this site. Choose the username carefully, it cannot be changed.' ) . '</li></ol></p>';
+	echo '<p>' . __( 'That person will be sent an email asking them to click a link confirming the invite. New users will then be sent an email with a randomly generated password and a login link.' ) . '</p>';
+}
 ?>
 <form action="#add-new-user" method="post" name="adduser" id="adduser" class="add:users: validate">
 <?php wp_nonce_field('add-user') ?>
@@ -92,6 +181,7 @@ foreach ( array('user_login' => 'login', 'first_name' => 'firstname', 'last_name
 $new_user_send_password = !$_POST || isset($_POST['send_password']);
 ?>
 <table class="form-table">
+<?php if ( !is_multisite() ) { ?>
 	<tr class="form-field form-required">
 		<th scope="row"><label for="user_login"><?php _e('Username'); ?> <span class="description"><?php _e('(required)'); ?></span></label>
 		<input name="action" type="hidden" id="action" value="adduser" /></th>
@@ -130,7 +220,16 @@ $new_user_send_password = !$_POST || isset($_POST['send_password']);
 		<td><label for="send_password"><input type="checkbox" name="send_password" id="send_password" <?php checked($new_user_send_password, true); ?> /> <?php _e('Send this password to the new user by email.'); ?></label></td>
 	</tr>
 <?php endif; ?>
-
+<?php } else { // multisite ?>
+	<tr class="form-field form-required">
+		<th scope="row"><label for="user_login"><?php _e('Username (required)') ?></label><input name="action" type="hidden" id="action" value="adduser" /></th>
+		<td ><input name="user_login" type="text" id="user_login" value="<?php echo $new_user_login; ?>" aria-required="true" /></td>
+	</tr>
+	<tr class="form-field form-required">
+		<th scope="row"><label for="email"><?php _e('E-mail (required)') ?></label></th>
+		<td><input name="email" type="text" id="email" value="<?php echo $new_user_email; ?>" /></td>
+	</tr>
+<?php } ?>
 	<tr class="form-field">
 		<th scope="row"><label for="role"><?php _e('Role'); ?></label></th>
 		<td><select name="role" id="role">
@@ -142,6 +241,13 @@ $new_user_send_password = !$_POST || isset($_POST['send_password']);
 			</select>
 		</td>
 	</tr>
+
+	<?php if ( is_multisite() && is_super_admin() ) { ?>
+	<tr class="form-field">
+		<th scope="row"><label for="noconfirmation"><?php _e('Skip Confirmation Email') ?></label></th>
+		<td><input name="noconfirmation" type="checkbox" id="noconfirmation" value="1" /> <label for="noconfirmation"><?php _e( 'Site administrators can add a user without sending the confirmation email.' ); ?></label></td>
+	</tr>
+	<?php } ?>
 </table>
 <p class="submit">
 	<input name="adduser" type="submit" id="addusersub" class="button-primary" value="<?php esc_attr_e('Add User') ?>" />

wp-admin/users.php

@@ -98,10 +98,18 @@ case 'dodelete':
 		}
 		switch($_REQUEST['delete_option']) {
 		case 'delete':
+			if ( !is_multisite() ) {
 				wp_delete_user($id);
+			} else {
+				remove_user_from_blog($id, $blog_id); // WPMU only remove user from blog
+			}
 			break;
 		case 'reassign':
+			if ( !is_multisite() ) {
 				wp_delete_user($id, $_REQUEST['reassign_user']);
+			} else {
+				remove_user_from_blog($id, $blog_id, $_REQUEST['reassign_user']);
+			}
 			break;
 		}
 		++$delete_count;
@@ -153,7 +161,12 @@ case 'delete':
 			$go_delete = true;
 		}
 	}
+	if ( !is_multisite() ) {
 		$all_logins = $wpdb->get_results("SELECT ID, user_login FROM $wpdb->users ORDER BY user_login");
+	} else {
+		// WPMU only searches users of current blog
+		$all_logins = $wpdb->get_results("SELECT ID, user_login FROM $wpdb->users, $wpdb->usermeta WHERE $wpdb->users.ID = $wpdb->usermeta.user_id AND meta_key = '".$wpdb->prefix."capabilities' ORDER BY user_login");
+	}
 	$user_dropdown = '<select name="reassign_user">';
 	foreach ( (array) $all_logins as $login )
 		if ( $login->ID == $current_user->ID || !in_array($login->ID, $userids) )
@@ -239,7 +252,7 @@ if ( ! empty($messages) ) {
 
 <div class="wrap">
 <?php screen_icon(); ?>
-<h2><?php echo esc_html( $title ); ?>  <a href="user-new.php" class="button add-new-h2"><?php echo esc_html_x('Add New', 'user'); ?></a> <?php
+<h2><?php echo esc_html( $title ); if ( !is_multisite() || get_site_option( 'add_new_users' ) ) { ?>  <a href="user-new.php" class="button add-new-h2"><?php echo esc_html_x('Add New', 'user'); ?></a><?php }
 if ( isset($_GET['usersearch']) && $_GET['usersearch'] )
 	printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( $_GET['usersearch'] ) ); ?>
 </h2>
@@ -385,6 +398,16 @@ foreach ( $wp_user_search->get_results() as $userid ) {
 </form>
 </div>
 
+<?php
+if ( is_multisite() ) {
+	foreach ( array('user_login' => 'user_login', 'first_name' => 'user_firstname', 'last_name' => 'user_lastname', 'email' => 'user_email', 'url' => 'user_uri', 'role' => 'user_role') as $formpost => $var ) {
+		$var = 'new_' . $var;
+		$$var = isset($_REQUEST[$formpost]) ? esc_attr(stripslashes($_REQUEST[$formpost])) : '';
+	}
+	unset($name);
+}
+?>
+
 <br class="clear" />
 <?php
 break;