user_op

=== modified file 'modules/user/user.module'--- modules/user/user.module	2006-10-14 14:15:40 +0000+++ modules/user/user.module	2006-10-15 16:42:37 +0000@@ -2090,19 +2090,6 @@ function user_admin_account_validate($fo function user_user_operations() {   global $form_values; -  $roles = user_roles(1);-  unset($roles[DRUPAL_AUTHENTICATED_RID]);  // Can't edit authenticated role.--  $add_roles = array();-  foreach ($roles as $key => $value) {-    $add_roles['add_role-'. $key] = $value;-  }--  $remove_roles = array();-  foreach ($roles as $key => $value) {-    $remove_roles['remove_role-'. $key] = $value;-  }-   $operations = array(     'unblock' => array(       'label' => t('Unblock the selected users'),@@ -2112,27 +2099,53 @@ function user_user_operations() {       'label' => t('Block the selected users'),       'callback' => 'user_user_operations_block',     ),-    t('Add a role to the selected users') => array(-      'label' => $add_roles,-    ),-    t('Remove a role from the selected users') => array(-      'label' => $remove_roles,-    ),     'delete' => array(       'label' => t('Delete the selected users'),     ),   ); +  if (user_access('administer access control')) {+    $roles = user_roles(1);+    unset($roles[DRUPAL_AUTHENTICATED_RID]);  // Can't edit authenticated role.++    $add_roles = array();+    foreach ($roles as $key => $value) {+      $add_roles['add_role-'. $key] = $value;+    }++    $remove_roles = array();+    foreach ($roles as $key => $value) {+      $remove_roles['remove_role-'. $key] = $value;+    }++    $role_operations = array(+      t('Add a role to the selected users') => array(+        'label' => $add_roles,+      ),+      t('Remove a role from the selected users') => array(+        'label' => $remove_roles,+      ),+    );++    array_merge($operations, $role_operations);+  }+   // If the form has been posted, we need to insert the proper data for role editing if necessary.   if ($form_values) {     $operation_rid = explode('-', $form_values['operation']);     $operation = $operation_rid[0];     $rid = $operation_rid[1];     if ($operation == 'add_role' || $operation == 'remove_role') {-      $operations[$form_values['operation']] = array(-        'callback' => 'user_multiple_role_edit',-        'callback arguments' => array($operation, $rid),-      );+      if (user_access('administer access control')) {+        $operations[$form_values['operation']] = array(+          'callback' => 'user_multiple_role_edit',+          'callback arguments' => array($operation, $rid),+        );+      }+      else {+        watchdog('security', t('Detected malicious attempt to alter protected user fields.'), WATCHDOG_WARNING);+        return;+      }     }   }