Commit Graph

234 Commits

Author SHA1 Message Date
Ryan McCue 3a449ea543 Roles/Capabilities: Add meta-caps for comment, term, and user meta.
Additionally, use these meta-caps in the REST API endpoints.

Previously, register_meta()'s auth_callback had no effect for non-post meta. This introduces `{add,edit,delete}_{comment,term,user}_meta` meta-caps to match the existing post meta capabilities. These are currently only used in the REST API.

Props tharsheblows, boonebgorges.
Fixes #38303, fixes #38412.

Built from https://develop.svn.wordpress.org/trunk@39179


git-svn-id: http://core.svn.wordpress.org/trunk@39119 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-11-09 03:42:30 +00:00
Weston Ruter 08712b4baa Customize: Rename `unfiltered_css` meta capability to `edit_css`; add `revisions` support to `custom_css` post type.
Props lukecavanagh, georgestephanis, westonruter.
See #38672, #35395.

Built from https://develop.svn.wordpress.org/trunk@39175


git-svn-id: http://core.svn.wordpress.org/trunk@39115 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-11-09 01:12:30 +00:00
John Blackbourn 2b6ceeb465 Customize: Correct the capability mapping and associated tests for the `unfiltered_css` capability.
Fixes #35395

Built from https://develop.svn.wordpress.org/trunk@39016


git-svn-id: http://core.svn.wordpress.org/trunk@38958 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-10-30 12:47:31 +00:00
Weston Ruter 1ccd9e7a6c Customize: Introduce custom CSS for extending theme styles.
* Custom CSS is associated with a given theme and is displayed in an inline `style` element at the `wp_head` hook after the `wp_print_styles` is called so that it overrides any enqueued stylesheets.
* A `wp_get_custom_css()` function is used for accessing the CSS associated with the current theme (or another theme) and a `wp_get_custom_css` filter for manipulating it.
* CSS is managed in customizer via a new "Additional CSS" section with a single `textarea` control. 
* `WP_Customize_Section::$description_hidden` is introduced for hiding extended descriptions in customizer sections behind a help toggle as done with panels.
* CSS is stored in a `custom_css` post type with the theme (stylesheet) slug as the `post_name`.
* `WP_Customize_Custom_CSS_Setting` is introduced to handle validation of CSS, previewing, and persisting the CSS to the `custom_css` post type.
* The `custom_css` setting is tied to a new `unfiltered_css` capability which maps to `unfiltered_html` by default.
* Escaping the message in the notification template is removed to allow markup (`code` tags) to be rendered.

See https://make.wordpress.org/core/2016/10/11/feature-proposal-better-theme-customizations-via-custom-css-with-live-previews/

Props johnregan3, celloexpressions, folletto, westonruter.
Fixes #35395.

Built from https://develop.svn.wordpress.org/trunk@38829


git-svn-id: http://core.svn.wordpress.org/trunk@38772 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-10-19 18:15:31 +00:00
John Blackbourn b84023ea33 Taxonomy: Introduce more fine grained capabilities for managing taxonomy terms.
This introduces the singular `edit_term`, `delete_term`, and `assign_term` meta capabilities for terms, and switches the base capability name for tags from `manage_categories` to `manage_post_tags` and the corresponding `edit_post_tags`, `delete_post_tags`, and `assign_post_tags`.

All of these capabilities ultimately map to `manage_categories` so by default there is no change in the behaviour of the capabilities for categories, tags, or custom taxonomies. The `map_meta_cap` filter and the `capabilities` argument when registering a taxonomy now allow for control over editing, deleting, and assigning individual terms, as well as a separation of capabilities for tags from those of categories.

Fixes #35614
Props johnjamesjacoby for feedback

Built from https://develop.svn.wordpress.org/trunk@38698


git-svn-id: http://core.svn.wordpress.org/trunk@38641 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-30 22:40:28 +00:00
John Blackbourn 52cf3d3d0f Role/Capability: Add explicit cases to `map_meta_cap()` for various meta capabilities that are used in core. This will allow more complete meta and primitive capability unit tests in #38191.
Fixes #38201

Built from https://develop.svn.wordpress.org/trunk@38695


git-svn-id: http://core.svn.wordpress.org/trunk@38638 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-09-30 22:06:28 +00:00
John Blackbourn 32d5e7f31d Role/Capability: Only users who can manage options should be able to trash/delete the page for posts or the front page, as they are the only users who can restore it or subsequently alter the "Front page displays" setting.
Fixes #37580
Props JakePT

Built from https://develop.svn.wordpress.org/trunk@38378


git-svn-id: http://core.svn.wordpress.org/trunk@38319 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-08-26 18:23:31 +00:00
Helen Hou-Sandí 69ccab3405 Introduce an expanded meta registration API.
`register_meta()` has been altered to accept an array of arguments as the third parameter in order to support its usage beyond XML-RPC, notably in the REST API and other projects that may build on top of meta, such as a potential Fields API. Arguments are whitelisted to reserve the right for core to add more later.

New functions added to complement this expansion are:
* `registered_meta_key_exists()`
* `unregister_meta_key()`
* `get_registered_meta_keys()`
* `get_registered_metadata()`
* A "private" function for the aforementioned whitelisting.

There still need to be lots of tests written for previous and new behaviors, and many things are subject to change. Maybe things will explode. #yolo

props jeremyfelt, ericlewis, sc0ttkclark, helen, rmccue, ocean90, voldemortensen.
see #35658.

Built from https://develop.svn.wordpress.org/trunk@37924


git-svn-id: http://core.svn.wordpress.org/trunk@37865 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-06-30 01:02:29 +00:00
Drew Jaynes 9cb5247392 Docs: Standardize filter docs in remaining wp-includes/* files to use third-person singular verbs per the inline documentation standards for PHP.
See #36913.

Built from https://develop.svn.wordpress.org/trunk@37518


git-svn-id: http://core.svn.wordpress.org/trunk@37486 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-05-22 18:50:28 +00:00
Drew Jaynes fe3b007fdd Docs: Remove inline `@see` tags from function, class, and method references in inline docs.
Known functions, classes, and methods are now auto-linked in Code Reference pages following #meta1483.

Note: Hook references are still linked via inline `@see` tags due to the unlikelihood of reliably matching for known hooks based on a RegEx pattern.

See #32246.

Built from https://develop.svn.wordpress.org/trunk@37342


git-svn-id: http://core.svn.wordpress.org/trunk@37308 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-05-02 04:00:28 +00:00
Jeremy Felt 6cc19b5e2e Multisite: Relocate `revoke_super_admin()` and `grant_super_admin()`
Moving these functions to `wp-includes/capabilities.php` allows plugins to access more than just `is_super_admin()` and `get_super_admin()` from the front end without including a file via `wp-admin/`. Add an `is_multisite()` check to prevent use of these on single site environments now that they have left `ms.php`..

Props johnjamesjacoby.
Fixes #21788.

Built from https://develop.svn.wordpress.org/trunk@37200


git-svn-id: http://core.svn.wordpress.org/trunk@37166 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-04-14 03:35:27 +00:00
Drew Jaynes 9daf7a88a3 Docs: Add a note to the DocBlock for `current_user_can()` to explain that it will always return true for super admins, unless specifically denied.
Props finnj.
Fixes #35551.

Built from https://develop.svn.wordpress.org/trunk@36492


git-svn-id: http://core.svn.wordpress.org/trunk@36459 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-02-07 01:27:26 +00:00
Eric Lewis 22467e840f Networks and sites: Replace "blog" usage with "site" in docs.
Multisite functions use the term "blog" to refer to what we now call a "site," e.g. `get_current_blog_id()`. These functions are here to stay because of our commitment to backwards compatibility. What we can do is set the documentation straight.

See #35417.

Built from https://develop.svn.wordpress.org/trunk@36416


git-svn-id: http://core.svn.wordpress.org/trunk@36383 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-28 03:35:27 +00:00
Pascal Birchler 68f12521c8 Post Types: Introduce `unregister_post_type()`.
This new function can be used to completely unregister non built-in post types.

Fixes #14761.
Built from https://develop.svn.wordpress.org/trunk@36316


git-svn-id: http://core.svn.wordpress.org/trunk@36283 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2016-01-15 12:20:27 +00:00
John Blackbourn 6f37afb6ec When a post is scheduled for publication, treat it the same as a published post when calculating the capabilities required to edit or delete it.
Fixes #33694

Built from https://develop.svn.wordpress.org/trunk@35747


git-svn-id: http://core.svn.wordpress.org/trunk@35711 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-29 02:27:18 +00:00
Andrew Nacin 1579e45d41 Simplify the include graph after work to split out classes.
see #33413. More details there.

Built from https://develop.svn.wordpress.org/trunk@35718


git-svn-id: http://core.svn.wordpress.org/trunk@35682 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-11-20 07:24:30 +00:00
Drew Jaynes 4ddb22bd09 Docs: The Users subpackage is plural.
See #33701.

Built from https://develop.svn.wordpress.org/trunk@34412


git-svn-id: http://core.svn.wordpress.org/trunk@34376 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-09-22 13:46:25 +00:00
Drew Jaynes b0749a1a06 Docs: Clarify the file header summary for wp-includes/capabilities.php, which was broken up into multiple files in [33752].
Also adds inline DocBlocks for files now brought in via `require_once()` from this file.

See #33413. See #33701.

Built from https://develop.svn.wordpress.org/trunk@34398


git-svn-id: http://core.svn.wordpress.org/trunk@34362 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-09-22 13:06:25 +00:00
Scott Taylor df1c0c2363 Roles: move classes into their own file. `capbilities.php` loads the new files, so this is 100% BC if someone is loading `capbilities.php` directly. New files created using `svn cp`.
Creates: 
`class-wp-roles.php` 
`class-wp-role.php` 
`class-wp-user.php` 
`capbilities-functions.php` 

`capbilities.php` contains only top-level code. Class files only contains classes. Functions file only contains functions.

See #33413.

Built from https://develop.svn.wordpress.org/trunk@33752


git-svn-id: http://core.svn.wordpress.org/trunk@33720 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-08-26 04:58:21 +00:00
Dominik Schilling f74a907eac Capabilities: Fall back to the `edit_posts` capability for orphaned comments.
Also avoid PHP notices because of orphaned comments in the comments list table.
Includes unit test.

props pento, dd32.
fixes #33154.
Built from https://develop.svn.wordpress.org/trunk@33614


git-svn-id: http://core.svn.wordpress.org/trunk@33581 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-08-13 22:31:24 +00:00
Gary Pendergast fe5a844be5 Capabilities: When creating an auto-draft, ensure that the current user still has permission to do so.
Built from https://develop.svn.wordpress.org/trunk@33357


git-svn-id: http://core.svn.wordpress.org/trunk@33329 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-07-22 04:02:25 +00:00
Drew Jaynes 665c3936d4 Fix summaries for for `WP_User->__call()` and `wp_roles()`, both added in 4.3.
See [32731], [32548]. See #32891.

Built from https://develop.svn.wordpress.org/trunk@33214


git-svn-id: http://core.svn.wordpress.org/trunk@33186 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-07-13 20:01:25 +00:00
John Blackbourn 4ad1dc2a1b Ensure the `create_users` capability check checks the super admin status of the user in question, rather than the current user.
Built from https://develop.svn.wordpress.org/trunk@32811


git-svn-id: http://core.svn.wordpress.org/trunk@32782 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-06-17 00:03:27 +00:00
Andrew Nacin 748b3763cb Add add_user_role and remove_user_role actions for WP_User::add_role() and remove_role().
props shooper.
fixes #32060.

Built from https://develop.svn.wordpress.org/trunk@32771


git-svn-id: http://core.svn.wordpress.org/trunk@32742 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-06-14 19:26:25 +00:00
Scott Taylor 3b1e434c3b Add the proper access modifier to `_init_caps()` in `WP_User`. Add `__call()` for BC.
See #32444.

Built from https://develop.svn.wordpress.org/trunk@32731


git-svn-id: http://core.svn.wordpress.org/trunk@32702 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-06-12 17:26:25 +00:00
Scott Taylor 19a3aacc94 Add `@static*` annotations where they are missing.
Initialize all static vars that are not, most to `null`.

See #32444.

Built from https://develop.svn.wordpress.org/trunk@32650


git-svn-id: http://core.svn.wordpress.org/trunk@32620 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-05-29 15:43:29 +00:00
Scott Taylor bd8fafea54 Use `void` instead of `null` where appropriate when pipe-delimiting `@return` types. If a `@return` only contains `void`, remove it.
See #32444.

Built from https://develop.svn.wordpress.org/trunk@32568


git-svn-id: http://core.svn.wordpress.org/trunk@32538 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-05-24 05:40:25 +00:00
Drew Jaynes e90a327694 Add a missing `@since` version to a function introduced in [32541].
See #32444.

Built from https://develop.svn.wordpress.org/trunk@32548


git-svn-id: http://core.svn.wordpress.org/trunk@32518 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-05-22 17:38:25 +00:00
Scott Taylor 1b52916239 Create a function, `wp_roles()`, to DRY the inline instantiation of the `$wp_roles` global.
Add missing doc blocks for `capabilities.php`.

See #32444.

Built from https://develop.svn.wordpress.org/trunk@32541


git-svn-id: http://core.svn.wordpress.org/trunk@32511 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-05-22 04:47:24 +00:00
Scott Taylor e724ed2b04 In `capabilities.php`, clarify/add some `return` docs.
See #32444.

Built from https://develop.svn.wordpress.org/trunk@32530


git-svn-id: http://core.svn.wordpress.org/trunk@32500 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-05-21 20:47:26 +00:00
Gary Pendergast 2bb5d8529f In Multisite, prevent plugins from unintentionally switching sites.
Props mdawaffe.


Built from https://develop.svn.wordpress.org/trunk@32173


git-svn-id: http://core.svn.wordpress.org/trunk@32148 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-04-20 07:27:27 +00:00
Jeremy Felt b5b5c98e0a Introduce delete_site meta capability.
Map `delete_site` as a meta capability to `manage_options` so that the ability to delete sites can be more granularly managed for individual site administrators on a multisite network.

Props thomaswm.

Fixes #30470.

Built from https://develop.svn.wordpress.org/trunk@31673


git-svn-id: http://core.svn.wordpress.org/trunk@31654 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-03-08 02:10:30 +00:00
Scott Taylor 4ce271ea86 Cleanup the `@property` annotations for `WP_User`.
See #30799.

Built from https://develop.svn.wordpress.org/trunk@31555


git-svn-id: http://core.svn.wordpress.org/trunk@31536 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-02-26 05:54:24 +00:00
Scott Taylor cde4c83091 [31210] broke Supportflow on dotorg, which declares these methods as `protected`. Switch to `protected` for the noop methods. The subclasses can make them more visible using `public`.
See #30799.

Built from https://develop.svn.wordpress.org/trunk@31211


git-svn-id: http://core.svn.wordpress.org/trunk@31192 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-01-16 18:37:24 +00:00
Scott Taylor 6f8e01adf2 In `WP_User`, `->get_role_caps()` and `->update_user_level_from_caps()` must be called inside `->add_cap()` and `->remove_cap()` after updating user meta. `->has_cap()` checks are currently failing directly after calling `->add_cap()`.
Adds unit test.

Props rachelbaker.
Fixes #28374.

Built from https://develop.svn.wordpress.org/trunk@31190


git-svn-id: http://core.svn.wordpress.org/trunk@31171 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-01-16 01:49:25 +00:00
Scott Taylor fe6b5983df In PHP 5.0.0, `is_a()` became deprecated in favour of the `instanceof` operator. Calling `is_a()` would result in an `E_STRICT` warning.
In PHP 5.3.0, `is_a()` is no longer deprecated, and will therefore no longer throw `E_STRICT` warnings.

To avoid warnings in PHP < 5.3.0, convert all `is_a()` calls to `$var instanceof WP_Class` calls.

`instanceof` does not throw any error if the variable being tested is not an object, it simply returns `false`.

Props markoheijnen, wonderboymusic.
Fixes #25672.

Built from https://develop.svn.wordpress.org/trunk@31188


git-svn-id: http://core.svn.wordpress.org/trunk@31169 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-01-16 01:06:24 +00:00
Scott Taylor a4092e90f0 In `WP_Roles`, only allow `__call()` to run against `->_init()`.
See #30891.

Built from https://develop.svn.wordpress.org/trunk@31147


git-svn-id: http://core.svn.wordpress.org/trunk@31128 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-01-11 22:23:23 +00:00
Scott Taylor 5547115dc2 Fix some `@param` docs that have chars too close them.
Add `@property` annotations to `WP_User` and `WP_Post`.
Remove erroneous `@param`s from image editor class methods.
Officially add the property `$_column_headers` to `WP_List_Table`.	

See #30799.

Built from https://develop.svn.wordpress.org/trunk@31127


git-svn-id: http://core.svn.wordpress.org/trunk@31108 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-01-10 06:57:22 +00:00
Scott Taylor e029005847 Access Modifiers:
* In `WP_Plugin_Install_List_Table`, use `public` instead of `var`
* In `WP_User`, `->data` is accessed directly on an instance if the constructor receives it: make it `public`
* In `WP_Locale`, every property is exported to a global and is already `public` via `var`, half of the properties are accessed directly already, make them all `public`
* In `WP_Rewrite`, several properties are accessed publicly in functions via the `$wp_rewrite` global, make those props `public`.
* In `WP_Rewrite`, the property `->comment_feed_structure` was misspelled as `->comments_feed_structure`

See #30799.

Built from https://develop.svn.wordpress.org/trunk@31078


git-svn-id: http://core.svn.wordpress.org/trunk@31059 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-01-08 05:44:23 +00:00
Dion Hulse c975c8eeb0 Preinitialize WP_User::$data to an object in the event an empty user object is created. Avoids a "Creating default object from empty value" PHP Warning.
Fixes #28019

Built from https://develop.svn.wordpress.org/trunk@31049


git-svn-id: http://core.svn.wordpress.org/trunk@31030 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2015-01-05 01:41:23 +00:00
Scott Taylor 586c1ac7bc Fix docs for `WP_User::allcaps`:
The `allcaps` property of the `WP_User` class represents all of the caps of the user, not the caps of the user's role. Introduced in [26126].

Props dlh.
Fixes #30852.

Built from https://develop.svn.wordpress.org/trunk@31013


git-svn-id: http://core.svn.wordpress.org/trunk@30994 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-12-31 18:15:23 +00:00
Scott Taylor 42f5acd869 Improve some docs for `@param`. Remove an unneeded `$wpdb` global import.
See #30799.

Built from https://develop.svn.wordpress.org/trunk@30979


git-svn-id: http://core.svn.wordpress.org/trunk@30965 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-12-20 20:56:22 +00:00
Scott Taylor e619abda6e Improve various `@param` docs for `src/wp-includes/*`.
See #30224.

Built from https://develop.svn.wordpress.org/trunk@30681


git-svn-id: http://core.svn.wordpress.org/trunk@30671 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-12-01 01:34:24 +00:00
Drew Jaynes bffe95d34c Docs Formatting: Backtick-escape inline code for all remaining dynamic hook docs in wp-includes/*.
Affects DocBlocks for the following hooks:
* `auth_post_meta_{$meta_key}`
* `term_links-$taxonomy`
* `customize_render_control_ . $this->id`
* `customize_render_panel_{$this->id}`
* `customize_render_section_{$this->id}`
* `customize_preview_{$this->id}`
* `customize_save_ . $this->id_data[ 'base' ]`
* `customize_update_ . $this->type`
* `customize_value_ . $this->id_data[ 'base' ]`
* `customize_sanitize_js_{$this->id}`
* `comment_form_field_{$name}`
* `comment_{$old_status}_to_{$new_status}`
* `comment_{$new_status}_{$comment->comment_type}`
* `extra_{$context}_headers`
* `get_template_part_{$slug}`
* `get_the_generator_{$type}`
* `get_{$adjacent}_post_join`
* `get_{$adjacent}_post_where`
* `get_{$adjacent}_post_sort`
* `{$adjacent}_post_rel_link`
* `{$adjacent}_post_link`
* `{$adjacent}_image_link`
* `blog_option_{$option}`
* `$permastructname . _rewrite_rules`
* `{$type}_template`
* `theme_mod_{$name}`
* `pre_set_theme_mod_$name`
* `current_theme_supports-{$feature}`
* `get_user_option_{$option}`
* `edit_user_{$field}`
* `pre_user_{$field}`
* `user_{$field}`

See #30552.

Built from https://develop.svn.wordpress.org/trunk@30656


git-svn-id: http://core.svn.wordpress.org/trunk@30646 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-11-30 12:10:23 +00:00
Drew Jaynes 8f6188ae53 Ensure inline code is markdown-escaped as such, and that code snippets in descriptions are properly indented.
Affects DocBlocks for the following core elements:
* Two arguments in `_walk_bookmarks()`
* A code snippet in the class header for `WP_Roles`
* A code snippet in the class header for `WP_HTTP_Proxy`
* Inline code fixes in the summary and a parameter description for `WP_oEmbed::discover()`
* An argument description in `_WP_Editors::parse_settings()`
* Inline code fixes in the summary and a parameter description the `embed_oembed_discover` hook.

Props rarst.
See #30473.

Built from https://develop.svn.wordpress.org/trunk@30536


git-svn-id: http://core.svn.wordpress.org/trunk@30525 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-11-24 04:42:22 +00:00
Drew Jaynes 66c47f29bb Correct references of `@uses $wpdb` in core documentation to use `@global`.
See #30191, [30105].
Fixes #30217.

Built from https://develop.svn.wordpress.org/trunk@30122


git-svn-id: http://core.svn.wordpress.org/trunk@30122 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-10-31 17:56:22 +00:00
Andrew Nacin ac3dd27737 Plugin/Theme Uploads: New capabilities; unify UIs; ensure compatibility with old filters.
Introduce upload_plugins and upload_themes capabilities to allow blocking of plugin and theme uploads, versus the old hacky (and not secure) ways of just hiding UI tabs. These are simply meta capabilities that map to install_plugins and install_themes.
 
Also:
 * Use the same nice design for the plugin upload screen as the theme upload screen.
 * Better compatibility for the old install_themes_tabs filter added in [29002]. see #28578.
 * Ensure using the install_plugins_tabs filter to remove the upload tab removes the new button.
 * Use 'Add Plugins' instead of 'Install Plugins' to match 'Add Themes'.

fixes #29236.

Built from https://develop.svn.wordpress.org/trunk@29634


git-svn-id: http://core.svn.wordpress.org/trunk@29408 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-08-27 01:32:18 +00:00
Dominik Schilling 57c914f75a Customizer: Add meta capability `customize` which is mapped to `edit_theme_options`.
You can now allow users to access the Customizer, say for any user who can `edit_posts`, via `map_meta_cap` or `user_has_cap` filter. See ticket for examples.

props westonruter, nacin.
fixes #28605.
Built from https://develop.svn.wordpress.org/trunk@29170


git-svn-id: http://core.svn.wordpress.org/trunk@28954 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-07-14 19:01:16 +00:00
Drew Jaynes 52a8488a96 Fill out inline documentation for the `__call()` magic method added to the `WP_Roles` class in [28503].
See #22234 and #28885.

Built from https://develop.svn.wordpress.org/trunk@29153


git-svn-id: http://core.svn.wordpress.org/trunk@28937 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-07-14 00:12:14 +00:00
Scott Taylor b8d469600b These functions import `$wpdb` but do not use it.
See #27882.

Built from https://develop.svn.wordpress.org/trunk@28539


git-svn-id: http://core.svn.wordpress.org/trunk@28365 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2014-05-22 17:37:14 +00:00