Merge pull request #19602 from woocommerce/fix/19431

Link product import/export to import/export capabilities

assets/js/admin/woocommerce_admin.js

@@ -11,8 +11,12 @@ jQuery( function ( $ ) {
 		$blankslate     = $product_screen.find( '.woocommerce-BlankState' );
 
 	if ( 0 === $blankslate.length ) {
-		$title_action.after( '<a href="' + woocommerce_admin.urls.export_products + '" class="page-title-action">' + woocommerce_admin.strings.export_products + '</a>' );
+		if ( woocommerce_admin.urls.export_products ) {
-		$title_action.after( '<a href="' + woocommerce_admin.urls.import_products + '" class="page-title-action">' + woocommerce_admin.strings.import_products + '</a>' );
+			$title_action.after('<a href="' + woocommerce_admin.urls.export_products + '" class="page-title-action">' + woocommerce_admin.strings.export_products + '</a>');
+		}
+		if ( woocommerce_admin.urls.import_products ) {
+			$title_action.after( '<a href="' + woocommerce_admin.urls.import_products + '" class="page-title-action">' + woocommerce_admin.strings.import_products + '</a>' );
+		}
 	} else {
 		$title_action.hide();
 	}

includes/admin/class-wc-admin-assets.php

@@ -2,8 +2,6 @@
 /**
  * Load assets
  *
- * @author      WooThemes
- * @category    Admin
  * @package     WooCommerce/Admin
  * @version     2.1.0
  */
@@ -36,23 +34,23 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 			$screen         = get_current_screen();
 			$screen_id      = $screen ? $screen->id : '';
 
-			// Register admin styles
+			// Register admin styles.
 			wp_register_style( 'woocommerce_admin_menu_styles', WC()->plugin_url() . '/assets/css/menu.css', array(), WC_VERSION );
 			wp_register_style( 'woocommerce_admin_styles', WC()->plugin_url() . '/assets/css/admin.css', array(), WC_VERSION );
 			wp_register_style( 'jquery-ui-style', WC()->plugin_url() . '/assets/css/jquery-ui.min.css', array(), WC_VERSION );
 			wp_register_style( 'woocommerce_admin_dashboard_styles', WC()->plugin_url() . '/assets/css/dashboard.css', array(), WC_VERSION );
 			wp_register_style( 'woocommerce_admin_print_reports_styles', WC()->plugin_url() . '/assets/css/reports-print.css', array(), WC_VERSION, 'print' );
 
-			// Add RTL support for admin styles
+			// Add RTL support for admin styles.
 			wp_style_add_data( 'woocommerce_admin_menu_styles', 'rtl', 'replace' );
 			wp_style_add_data( 'woocommerce_admin_styles', 'rtl', 'replace' );
 			wp_style_add_data( 'woocommerce_admin_dashboard_styles', 'rtl', 'replace' );
 			wp_style_add_data( 'woocommerce_admin_print_reports_styles', 'rtl', 'replace' );
 
-			// Sitewide menu CSS
+			// Sitewide menu CSS.
 			wp_enqueue_style( 'woocommerce_admin_menu_styles' );
 
-			// Admin styles for WC pages only
+			// Admin styles for WC pages only.
 			if ( in_array( $screen_id, wc_get_screen_ids() ) ) {
 				wp_enqueue_style( 'woocommerce_admin_styles' );
 				wp_enqueue_style( 'jquery-ui-style' );
@@ -67,9 +65,7 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 				wp_enqueue_style( 'woocommerce_admin_print_reports_styles' );
 			}
 
-			/**
+			// @deprecated 2.3.
-			 * @deprecated 2.3
-			 */
 			if ( has_action( 'woocommerce_admin_css' ) ) {
 				do_action( 'woocommerce_admin_css' );
 				wc_deprecated_function( 'The woocommerce_admin_css action', '2.3', 'admin_enqueue_scripts' );
@@ -88,7 +84,7 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 			$wc_screen_id = sanitize_title( __( 'WooCommerce', 'woocommerce' ) );
 			$suffix       = defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ? '' : '.min';
 
-			// Register scripts
+			// Register scripts.
 			wp_register_script( 'woocommerce_admin', WC()->plugin_url() . '/assets/js/admin/woocommerce_admin' . $suffix . '.js', array( 'jquery', 'jquery-blockui', 'jquery-ui-sortable', 'jquery-ui-widget', 'jquery-ui-core', 'jquery-tiptip' ), WC_VERSION );
 			wp_register_script( 'jquery-blockui', WC()->plugin_url() . '/assets/js/jquery-blockui/jquery.blockUI' . $suffix . '.js', array( 'jquery' ), '2.70', true );
 			wp_register_script( 'jquery-tiptip', WC()->plugin_url() . '/assets/js/jquery-tiptip/jquery.tipTip' . $suffix . '.js', array( 'jquery' ), WC_VERSION, true );
@@ -178,20 +174,20 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 						'export_products' => __( 'Export', 'woocommerce' ),
 					),
 					'urls'                             => array(
-						'import_products' => esc_url_raw( admin_url( 'edit.php?post_type=product&page=product_importer' ) ),
+						'import_products' => current_user_can( 'import' ) ? esc_url_raw( admin_url( 'edit.php?post_type=product&page=product_importer' ) ) : null,
-						'export_products' => esc_url_raw( admin_url( 'edit.php?post_type=product&page=product_exporter' ) ),
+						'export_products' => current_user_can( 'export' ) ? esc_url_raw( admin_url( 'edit.php?post_type=product&page=product_exporter' ) ) : null,
 					),
 				);
 
 				wp_localize_script( 'woocommerce_admin', 'woocommerce_admin', $params );
 			}
 
-			// Edit product category pages
+			// Edit product category pages.
 			if ( in_array( $screen_id, array( 'edit-product_cat' ) ) ) {
 				wp_enqueue_media();
 			}
 
-			// Products
+			// Products.
 			if ( in_array( $screen_id, array( 'edit-product' ) ) ) {
 				wp_enqueue_script( 'woocommerce_quick-edit', WC()->plugin_url() . '/assets/js/admin/quick-edit' . $suffix . '.js', array( 'jquery', 'woocommerce_admin' ), WC_VERSION );
 
@@ -204,7 +200,7 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 				wp_localize_script( 'woocommerce_quick-edit', 'woocommerce_quick_edit', $params );
 			}
 
-			// Meta boxes
+			// Meta boxes.
 			if ( in_array( $screen_id, array( 'product', 'edit-product' ) ) ) {
 				wp_enqueue_media();
 				wp_register_script( 'wc-admin-product-meta-boxes', WC()->plugin_url() . '/assets/js/admin/meta-boxes-product' . $suffix . '.js', array( 'wc-admin-meta-boxes', 'media-models' ), WC_VERSION );
@@ -224,6 +220,7 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 					'load_variations_nonce'               => wp_create_nonce( 'load-variations' ),
 					'save_variations_nonce'               => wp_create_nonce( 'save-variations' ),
 					'bulk_edit_variations_nonce'          => wp_create_nonce( 'bulk-edit-variations' ),
+					/* translators: %d: Number of variations */
 					'i18n_link_all_variations'            => esc_js( sprintf( __( 'Are you sure you want to link all variations? This will create a new variation for each and every possible combination of variation attributes (max %d per run).', 'woocommerce' ), defined( 'WC_MAX_LINKED_VARIATIONS' ) ? WC_MAX_LINKED_VARIATIONS : 50 ) ),
 					'i18n_enter_a_value'                  => esc_js( __( 'Enter a value', 'woocommerce' ) ),
 					'i18n_enter_menu_order'               => esc_js( __( 'Variation menu order (determines position in the list of variations)', 'woocommerce' ) ),
@@ -270,8 +267,11 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 				$post_id  = isset( $post->ID ) ? $post->ID : '';
 				$currency = '';
 
-				if ( $post_id && in_array( get_post_type( $post_id ), wc_get_order_types( 'order-meta-boxes' ) ) && ( $order = wc_get_order( $post_id ) ) ) {
+				if ( $post_id && in_array( get_post_type( $post_id ), wc_get_order_types( 'order-meta-boxes' ) ) ) {
-					$currency = $order->get_currency();
+					$order = wc_get_order( $post_id );
+					if ( $order ) {
+						$currency = $order->get_currency();
+					}
 				}
 
 				$params = array(
@@ -318,7 +318,7 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 					'currency_format_symbol'        => get_woocommerce_currency_symbol( $currency ),
 					'currency_format_decimal_sep'   => esc_attr( wc_get_price_decimal_separator() ),
 					'currency_format_thousand_sep'  => esc_attr( wc_get_price_thousand_separator() ),
-					'currency_format'               => esc_attr( str_replace( array( '%1$s', '%2$s' ), array( '%s', '%v' ), get_woocommerce_price_format() ) ), // For accounting JS
+					'currency_format'               => esc_attr( str_replace( array( '%1$s', '%2$s' ), array( '%s', '%v' ), get_woocommerce_price_format() ) ), // For accounting JS.
 					'rounding_precision'            => wc_get_rounding_precision(),
 					'tax_rounding_mode'             => wc_get_tax_rounding_mode(),
 					'product_types'                 => array_unique( array_merge( array( 'simple', 'grouped', 'variable', 'external' ), array_keys( wc_get_product_types() ) ) ),
@@ -333,13 +333,13 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 				wp_localize_script( 'wc-admin-meta-boxes', 'woocommerce_admin_meta_boxes', $params );
 			}
 
-			// Term ordering - only when sorting by term_order
+			// Term ordering - only when sorting by term_order.
-			if ( ( strstr( $screen_id, 'edit-pa_' ) || ( ! empty( $_GET['taxonomy'] ) && in_array( $_GET['taxonomy'], apply_filters( 'woocommerce_sortable_taxonomies', array( 'product_cat' ) ) ) ) ) && ! isset( $_GET['orderby'] ) ) {
+			if ( ( strstr( $screen_id, 'edit-pa_' ) || ( ! empty( $_GET['taxonomy'] ) && in_array( wp_unslash( $_GET['taxonomy'] ), apply_filters( 'woocommerce_sortable_taxonomies', array( 'product_cat' ) ) ) ) ) && ! isset( $_GET['orderby'] ) ) {
 
 				wp_register_script( 'woocommerce_term_ordering', WC()->plugin_url() . '/assets/js/admin/term-ordering' . $suffix . '.js', array( 'jquery-ui-sortable' ), WC_VERSION );
 				wp_enqueue_script( 'woocommerce_term_ordering' );
 
-				$taxonomy = isset( $_GET['taxonomy'] ) ? wc_clean( $_GET['taxonomy'] ) : '';
+				$taxonomy = isset( $_GET['taxonomy'] ) ? wc_clean( wp_unslash( $_GET['taxonomy'] ) ) : '';
 
 				$woocommerce_term_order_params = array(
 					'taxonomy' => $taxonomy,
@@ -348,13 +348,13 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 				wp_localize_script( 'woocommerce_term_ordering', 'woocommerce_term_ordering_params', $woocommerce_term_order_params );
 			}
 
-			// Product sorting - only when sorting by menu order on the products page
+			// Product sorting - only when sorting by menu order on the products page.
 			if ( current_user_can( 'edit_others_pages' ) && 'edit-product' === $screen_id && isset( $wp_query->query['orderby'] ) && 'menu_order title' === $wp_query->query['orderby'] ) {
 				wp_register_script( 'woocommerce_product_ordering', WC()->plugin_url() . '/assets/js/admin/product-ordering' . $suffix . '.js', array( 'jquery-ui-sortable' ), WC_VERSION, true );
 				wp_enqueue_script( 'woocommerce_product_ordering' );
 			}
 
-			// Reports Pages
+			// Reports Pages.
 			if ( in_array( $screen_id, apply_filters( 'woocommerce_reports_screen_ids', array( $wc_screen_id . '_page_wc-reports', 'toplevel_page_wc-reports', 'dashboard' ) ) ) ) {
 				wp_register_script( 'wc-reports', WC()->plugin_url() . '/assets/js/admin/reports' . $suffix . '.js', array( 'jquery', 'jquery-ui-datepicker' ), WC_VERSION );
 
@@ -366,7 +366,7 @@ if ( ! class_exists( 'WC_Admin_Assets', false ) ) :
 				wp_enqueue_script( 'flot-stack' );
 			}
 
-			// API settings
+			// API settings.
 			if ( $wc_screen_id . '_page_wc-settings' === $screen_id && isset( $_GET['section'] ) && 'keys' == $_GET['section'] ) {
 				wp_register_script( 'wc-api-keys', WC()->plugin_url() . '/assets/js/admin/api-keys' . $suffix . '.js', array( 'jquery', 'woocommerce_admin', 'underscore', 'backbone', 'wp-util', 'qrcode', 'wc-clipboard' ), WC_VERSION, true );
 				wp_enqueue_script( 'wc-api-keys' );

includes/admin/class-wc-admin-exporters.php

@@ -26,6 +26,10 @@ class WC_Admin_Exporters {
 	 * Constructor.
 	 */
 	public function __construct() {
+		if ( ! $this->export_allowed() ) {
+			return;
+		}
+
 		add_action( 'admin_menu', array( $this, 'add_to_menus' ) );
 		add_action( 'admin_head', array( $this, 'hide_from_menus' ) );
 		add_action( 'admin_enqueue_scripts', array( $this, 'admin_scripts' ) );
@@ -36,11 +40,20 @@ class WC_Admin_Exporters {
 		$this->exporters['product_exporter'] = array(
 			'menu'       => 'edit.php?post_type=product',
 			'name'       => __( 'Product Export', 'woocommerce' ),
-			'capability' => 'edit_products',
+			'capability' => 'export',
 			'callback'   => array( $this, 'product_exporter' ),
 		);
 	}
 
+	/**
+	 * Return true if WooCommerce export is allowed for current user, false otherwise.
+	 *
+	 * @return bool Whether current user can perform export.
+	 */
+	protected function export_allowed() {
+		return current_user_can( 'edit_products' ) && current_user_can( 'export' );
+	}
+
 	/**
 	 * Add menu items for our custom exporters.
 	 */
@@ -112,8 +125,8 @@ class WC_Admin_Exporters {
 	public function do_ajax_product_export() {
 		check_ajax_referer( 'wc-product-export', 'security' );
 
-		if ( ! current_user_can( 'edit_products' ) ) {
+		if ( ! $this->export_allowed() ) {
-			wp_die( -1 );
+			wp_send_json_error( array( 'message' => __( 'Insufficient privileges to export products.', 'woocommerce' ) ) );
 		}
 
 		include_once WC_ABSPATH . 'includes/export/class-wc-product-csv-exporter.php';

includes/admin/class-wc-admin-importers.php

@@ -23,6 +23,10 @@ class WC_Admin_Importers {
 	 * Constructor.
 	 */
 	public function __construct() {
+		if ( ! $this->import_allowed() ) {
+			return;
+		}
+
 		add_action( 'admin_menu', array( $this, 'add_to_menus' ) );
 		add_action( 'admin_init', array( $this, 'register_importers' ) );
 		add_action( 'admin_head', array( $this, 'hide_from_menus' ) );
@@ -33,11 +37,20 @@ class WC_Admin_Importers {
 		$this->importers['product_importer'] = array(
 			'menu'       => 'edit.php?post_type=product',
 			'name'       => __( 'Product Import', 'woocommerce' ),
-			'capability' => 'edit_products',
+			'capability' => 'import',
 			'callback'   => array( $this, 'product_importer' ),
 		);
 	}
 
+	/**
+	 * Return true if WooCommerce imports are allowed for current user, false otherwise.
+	 *
+	 * @return bool Whether current user can perform imports.
+	 */
+	protected function import_allowed() {
+		return current_user_can( 'edit_products' ) && current_user_can( 'import' );
+	}
+
 	/**
 	 * Add menu items for our custom importers.
 	 */
@@ -190,8 +203,8 @@ class WC_Admin_Importers {
 
 		check_ajax_referer( 'wc-product-import', 'security' );
 
-		if ( ! current_user_can( 'edit_products' ) || ! isset( $_POST['file'] ) ) { // PHPCS: input var ok.
+		if ( ! $this->import_allowed() || ! isset( $_POST['file'] ) ) { // PHPCS: input var ok.
-			wp_die( -1 );
+			wp_send_json_error( array( 'message' => __( 'Insufficient privileges to import products.', 'woocommerce' ) ) );
 		}
 
 		include_once WC_ABSPATH . 'includes/admin/importers/class-wc-product-csv-importer-controller.php';