Changeset 53105

Timestamp:

04/08/2022 06:24:32 AM (2 years ago)

Author:

peterwilsoncc

Message:

Users: Prevent author changes in bulk editor on large sites.

On large sites (with over 1000 users), include a hidden post_author field in the bulk editing interface to preven unexpected authorship changes.

Follow up to [53011], [53049].

Props georgestephanis, tobifjellner, peterwilsoncc, spacedmonkey, jb510.
Fixes #38741.

File:

• trunk/src/wp-admin/includes/class-wp-posts-list-table.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-posts-list-table.php

@@ -1654 +1654 @@
 
                 <?php
-                if ( post_type_supports( $screen->post_type, 'author' ) && ! wp_is_large_user_count() ) {
+                if ( post_type_supports( $screen->post_type, 'author' ) ) {
                     $authors_dropdown = '';
 
                     if ( current_user_can( $post_type_object->cap->edit_others_posts ) ) {
-                        $users_opt = array(
-                            'hide_if_only_one_author' => false,
-                            'capability'              => array( $post_type_object->cap->edit_posts ),
-                            'name'                    => 'post_author',
-                            'class'                   => 'authors',
-                            'multi'                   => 1,
-                            'echo'                    => 0,
-                            'show'                    => 'display_name_with_login',
-                        );
-
-                        if ( $bulk ) {
-                            $users_opt['show_option_none'] = __( '&mdash; No Change &mdash;' );
-                        }
-
-                        /**
-                         * Filters the arguments used to generate the Quick Edit authors drop-down.
-                         *
-                         * @since 5.6.0
-                         *
-                         * @see wp_dropdown_users()
-                         *
-                         * @param array $users_opt An array of arguments passed to wp_dropdown_users().
-                         * @param bool  $bulk      A flag to denote if it's a bulk action.
-                         */
-                        $users_opt = apply_filters( 'quick_edit_dropdown_authors_args', $users_opt, $bulk );
-
-                        $authors = wp_dropdown_users( $users_opt );
-
-                        if ( $authors ) {
-                            $authors_dropdown  = '<label class="inline-edit-author">';
-                            $authors_dropdown .= '<span class="title">' . __( 'Author' ) . '</span>';
-                            $authors_dropdown .= $authors;
-                            $authors_dropdown .= '</label>';
+                        $dropdown_name  = 'post_author';
+                        $dropdown_class = 'authors';
+                        if ( wp_is_large_user_count() ) {
+                            $authors_dropdown = sprintf( '<select name="%s" class="%s hidden"></select>', esc_attr( $dropdown_name ), esc_attr( $dropdown_class ) );
+                        } else {
+                            $users_opt = array(
+                                'hide_if_only_one_author' => false,
+                                'capability'              => array( $post_type_object->cap->edit_posts ),
+                                'name'                    => $dropdown_name,
+                                'class'                   => $dropdown_class,
+                                'multi'                   => 1,
+                                'echo'                    => 0,
+                                'show'                    => 'display_name_with_login',
+                            );
+
+                            if ( $bulk ) {
+                                $users_opt['show_option_none'] = __( '&mdash; No Change &mdash;' );
+                            }
+
+                            /**
+                             * Filters the arguments used to generate the Quick Edit authors drop-down.
+                             *
+                             * @since 5.6.0
+                             *
+                             * @see wp_dropdown_users()
+                             *
+                             * @param array $users_opt An array of arguments passed to wp_dropdown_users().
+                             * @param bool $bulk A flag to denote if it's a bulk action.
+                             */
+                            $users_opt = apply_filters( 'quick_edit_dropdown_authors_args', $users_opt, $bulk );
+
+                            $authors = wp_dropdown_users( $users_opt );
+
+                            if ( $authors ) {
+                                $authors_dropdown  = '<label class="inline-edit-author">';
+                                $authors_dropdown .= '<span class="title">' . __( 'Author' ) . '</span>';
+                                $authors_dropdown .= $authors;
+                                $authors_dropdown .= '</label>';
+                            }
                         }
                     } // current_user_can( 'edit_others_posts' )
@@ -1749 +1755 @@
 
                 <?php
-                if ( post_type_supports( $screen->post_type, 'author' ) && ! wp_is_large_user_count() && $bulk ) {
+                if ( post_type_supports( $screen->post_type, 'author' ) && $bulk ) {
                     echo $authors_dropdown;
                 }