WordPress version update

wp/wp-content/plugins/sqlite-database-integration/activate.php

@@ -14,47 +14,63 @@
  * @param string $plugin The plugin basename.
  */
 function sqlite_plugin_activation_redirect( $plugin ) {
-	if ( plugin_basename( SQLITE_MAIN_FILE ) === $plugin ) {
-		if ( wp_safe_redirect( admin_url( 'options-general.php?page=sqlite-integration' ) ) ) {
-			exit;
-		}
+	if (
+		plugin_basename( SQLITE_MAIN_FILE ) !== $plugin
+		|| ! current_user_can( sqlite_plugin_get_manage_capability() )
+	) {
+		return;
+	}
+
+	if ( wp_safe_redirect( sqlite_plugin_get_admin_page_url() ) ) {
+		exit;
 	}
 }
 add_action( 'activated_plugin', 'sqlite_plugin_activation_redirect' );
 
 /**
  * Check the URL to ensure we're on the plugin page,
  * the user has clicked the button to install SQLite,
- * and the nonce is valid.
+ * the user has permission to manage the database drop-in, and the nonce is valid.
  * If the above conditions are met, run the sqlite_plugin_copy_db_file() function,
  * and redirect to the install screen.
  *
  * @since 1.0.0
  */
 function sqlite_activation() {
-	global $current_screen;
-	if ( isset( $current_screen->base ) && 'settings_page_sqlite-integration' === $current_screen->base ) {
+	if (
+		! isset( $_GET['page'], $_GET['confirm-install'] )
+		|| 'sqlite-integration' !== $_GET['page']
+	) {
 		return;
 	}
-	if ( isset( $_GET['confirm-install'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'sqlite-install' ) ) {
 
-		// Handle upgrading from the performance-lab plugin.
-		if ( isset( $_GET['upgrade-from-pl'] ) ) {
-			global $wp_filesystem;
-			require_once ABSPATH . '/wp-admin/includes/file.php';
-			// Delete the previous db.php file.
-			$wp_filesystem->delete( WP_CONTENT_DIR . '/db.php' );
-			// Deactivate the performance-lab SQLite module.
-			$pl_option_name = defined( 'PERFLAB_MODULES_SETTING' ) ? PERFLAB_MODULES_SETTING : 'perflab_modules_settings';
-			$pl_option      = get_option( $pl_option_name, array() );
-			unset( $pl_option['database/sqlite'] );
-			update_option( $pl_option_name, $pl_option );
-		}
-		sqlite_plugin_copy_db_file();
-		// WordPress will automatically redirect to the install screen here.
-		wp_redirect( admin_url() );
-		exit;
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		wp_die(
+			esc_html__( 'Sorry, you are not allowed to install the SQLite database drop-in.', 'sqlite-database-integration' ),
+			403
+		);
+	}
+
+	check_admin_referer( 'sqlite-install' );
+
+	// Handle upgrading from the performance-lab plugin.
+	if ( isset( $_GET['upgrade-from-pl'] ) ) {
+		global $wp_filesystem;
+		require_once ABSPATH . '/wp-admin/includes/file.php';
+		// Delete the previous db.php file.
+		$wp_filesystem->delete( WP_CONTENT_DIR . '/db.php' );
+		// Deactivate the performance-lab SQLite module.
+		$pl_option_name = defined( 'PERFLAB_MODULES_SETTING' ) ? PERFLAB_MODULES_SETTING : 'perflab_modules_settings';
+		$pl_option      = get_option( $pl_option_name, array() );
+		unset( $pl_option['database/sqlite'] );
+		update_option( $pl_option_name, $pl_option );
 	}
+
+	sqlite_plugin_copy_db_file();
+
+	// WordPress will automatically redirect to the install screen here.
+	wp_redirect( admin_url() );
+	exit;
 }
 add_action( 'admin_init', 'sqlite_activation' );
 

wp/wp-content/plugins/sqlite-database-integration/admin-notices.php

@@ -12,6 +12,9 @@
  * When the plugin gets merged in wp-core, this is not to be ported.
  */
 function sqlite_plugin_admin_notice() {
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		return;
+	}
 
 	// Don't print notices in the plugin's admin screen.
 	global $current_screen;
@@ -66,11 +69,11 @@ function sqlite_plugin_admin_notice() {
 			/* translators: 1: db.php drop-in path, 2: Admin URL to deactivate the module */
 			__( 'The SQLite Integration plugin is active, but the %1$s file is missing. Please <a href="%2$s">deactivate the plugin</a> and re-activate it to try again.', 'sqlite-database-integration' ),
 			'<code>' . esc_html( basename( WP_CONTENT_DIR ) ) . '/db.php</code>',
-			esc_url( admin_url( 'plugins.php' ) )
+			esc_url( self_admin_url( 'plugins.php' ) )
 		)
 	);
 }
-add_action( 'admin_notices', 'sqlite_plugin_admin_notice' ); // Add the admin notices.
+add_action( is_multisite() ? 'network_admin_notices' : 'admin_notices', 'sqlite_plugin_admin_notice' ); // Add the admin notices.
 
 // Remove the PL-plugin admin notices for SQLite.
 remove_action( 'admin_notices', 'perflab_sqlite_plugin_admin_notice' );

wp/wp-content/plugins/sqlite-database-integration/admin-page.php

@@ -12,20 +12,30 @@
  * @since 1.0.0
  */
 function sqlite_add_admin_menu() {
-	add_options_page(
+	$parent_slug = is_multisite() ? 'settings.php' : 'options-general.php';
+
+	add_submenu_page(
+		$parent_slug,
 		__( 'SQLite integration', 'sqlite-database-integration' ),
 		__( 'SQLite integration', 'sqlite-database-integration' ),
-		'manage_options',
+		sqlite_plugin_get_manage_capability(),
 		'sqlite-integration',
 		'sqlite_integration_admin_screen'
 	);
 }
-add_action( 'admin_menu', 'sqlite_add_admin_menu' );
+add_action( is_multisite() ? 'network_admin_menu' : 'admin_menu', 'sqlite_add_admin_menu' );
 
 /**
  * The admin page contents.
  */
 function sqlite_integration_admin_screen() {
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		wp_die(
+			esc_html__( 'Sorry, you are not allowed to access the SQLite integration settings.', 'sqlite-database-integration' ),
+			403
+		);
+	}
+
 	$db_dropin_path = WP_CONTENT_DIR . '/db.php';
 
 	/*
@@ -56,7 +66,7 @@ function sqlite_integration_admin_screen() {
 					printf(
 						/* translators: 1: Admin URL to deactivate the module, 2: db.php drop-in path, */
 						__( 'The SQLite drop-in is enabled. To disable it and get back to your previous, MySQL database, you can <a href="%1$s">deactivate the plugin</a>. Alternatively, you can manually delete the %2$s file from your server.', 'sqlite-database-integration' ),
-						esc_url( admin_url( 'plugins.php' ) ),
+						esc_url( self_admin_url( 'plugins.php' ) ),
 						'<code>' . esc_html( basename( WP_CONTENT_DIR ) ) . '/db.php</code>'
 					);
 				?>
@@ -78,7 +88,16 @@ function sqlite_integration_admin_screen() {
 						?>
 					</p>
 				</div>
-				<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin.php?page=sqlite-integration&confirm-install&upgrade-from-pl' ), 'sqlite-install' ) ); ?>">
+				<?php
+				$upgrade_url = add_query_arg(
+					array(
+						'confirm-install' => '1',
+						'upgrade-from-pl' => '1',
+					),
+					sqlite_plugin_get_admin_page_url()
+				);
+				?>
+				<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( $upgrade_url, 'sqlite-install' ) ); ?>">
 					<?php
 					printf(
 						/* translators: %s: db.php drop-in path */
@@ -136,7 +155,7 @@ function sqlite_integration_admin_screen() {
 
 			<p><?php esc_html_e( 'By clicking the button below, you will be redirected to the WordPress installation screen to setup your new database', 'sqlite-database-integration' ); ?></p>
 
-			<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin.php?page=sqlite-integration&confirm-install' ), 'sqlite-install' ) ); ?>"><?php esc_html_e( 'Install SQLite database', 'sqlite-database-integration' ); ?></a>
+			<a class="button button-primary" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'confirm-install', '1', sqlite_plugin_get_admin_page_url() ), 'sqlite-install' ) ); ?>"><?php esc_html_e( 'Install SQLite database', 'sqlite-database-integration' ); ?></a>
 		<?php endif; ?>
 	</div>
 	<?php
@@ -152,6 +171,10 @@ function sqlite_integration_admin_screen() {
  * @param WP_Admin_Bar $admin_bar The admin bar object.
  */
 function sqlite_plugin_adminbar_item( $admin_bar ) {
+	if ( ! current_user_can( sqlite_plugin_get_manage_capability() ) ) {
+		return;
+	}
+
 	global $wpdb;
 
 	if ( defined( 'SQLITE_DB_DROPIN_VERSION' ) && defined( 'DB_ENGINE' ) && 'sqlite' === DB_ENGINE ) {
@@ -166,9 +189,23 @@ function sqlite_plugin_adminbar_item( $admin_bar ) {
 		'id'     => 'sqlite-db-integration',
 		'parent' => 'top-secondary',
 		'title'  => $title,
-		'href'   => esc_url( admin_url( 'options-general.php?page=sqlite-integration' ) ),
+		'href'   => esc_url( sqlite_plugin_get_admin_page_url() ),
 		'meta'   => false,
 	);
 	$admin_bar->add_node( $args );
 }
 add_action( 'admin_bar_menu', 'sqlite_plugin_adminbar_item', 999 );
+
+/**
+ * Get the SQLite integration admin page URL.
+ *
+ * @access private
+ *
+ * @return string Admin page URL.
+ */
+function sqlite_plugin_get_admin_page_url() {
+	if ( is_multisite() ) {
+		return network_admin_url( 'settings.php?page=sqlite-integration' );
+	}
+	return admin_url( 'options-general.php?page=sqlite-integration' );
+}

wp/wp-content/plugins/sqlite-database-integration/capabilities.php

@@ -0,0 +1,80 @@
+<?php
+
+/**
+ * Require SQLite management permission to deactivate an active integration.
+ *
+ * WordPress checks this capability when one plugin is deactivated, including
+ * each plugin in a site-level batch. It skips this per-plugin check for a
+ * Network Admin batch, so that case is handled separately below.
+ *
+ * @access private
+ *
+ * @param string[] $caps    Primitive capabilities required of the user.
+ * @param string   $cap     Capability being checked.
+ * @param int      $user_id User ID.
+ * @param mixed[]  $args    Additional capability arguments.
+ * @return string[] Required primitive capabilities.
+ */
+function sqlite_plugin_map_deactivation_capability( $caps, $cap, $user_id, $args ) {
+	if (
+		'deactivate_plugin' === $cap
+		&& isset( $args[0] )
+		&& plugin_basename( SQLITE_MAIN_FILE ) === $args[0]
+		&& sqlite_plugin_has_active_dropin()
+	) {
+		$caps[] = sqlite_plugin_get_manage_capability();
+	}
+	return $caps;
+}
+add_filter( 'map_meta_cap', 'sqlite_plugin_map_deactivation_capability', 10, 4 );
+
+/**
+ * WordPress does not check each plugin's permission when deactivating a Network
+ * Admin batch. Remove SQLite from the batch when the user cannot manage the
+ * network-wide drop-in, while allowing the other selected plugins to continue.
+ *
+ * @access private
+ */
+function sqlite_plugin_filter_network_bulk_deactivation() {
+	$is_network_bulk_deactivation = is_network_admin()
+		&& isset( $_REQUEST['action'] )
+		&& is_string( $_REQUEST['action'] )
+		&& 'deactivate-selected' === wp_unslash( $_REQUEST['action'] );
+
+	if (
+		$is_network_bulk_deactivation
+		&& sqlite_plugin_has_active_dropin()
+		&& ! current_user_can( sqlite_plugin_get_manage_capability() )
+	) {
+		/*
+		 * Remove only SQLite from the submitted list. WordPress will still check
+		 * whether the user may run bulk deactivation and whether the request is
+		 * valid before it deactivates the plugins left in the list.
+		 */
+		$plugins          = isset( $_POST['checked'] ) ? (array) $_POST['checked'] : array();
+		$_POST['checked'] = array_values( array_diff( $plugins, array( plugin_basename( SQLITE_MAIN_FILE ) ) ) );
+	}
+}
+add_action( 'load-plugins.php', 'sqlite_plugin_filter_network_bulk_deactivation' );
+
+/**
+ * Check whether the SQLite database drop-in is active.
+ *
+ * @access private
+ *
+ * @return bool Whether the SQLite database drop-in is active.
+ */
+function sqlite_plugin_has_active_dropin() {
+	return defined( 'SQLITE_DB_DROPIN_VERSION' ) && file_exists( WP_CONTENT_DIR . '/db.php' );
+}
+
+/**
+ * Get the capability required to manage the SQLite integration.
+ *
+ * @access private
+ *
+ * @return string Required capability.
+ */
+function sqlite_plugin_get_manage_capability() {
+	return is_multisite() ? 'manage_network_options' : 'manage_options';
+}