/**
  * If page edit capabilities are checked for a wiki page, grant them if current user has edit_wiki cap.
  * @global <type> $nxt_query
  * @param <array> $nxt_blogcaps : current user's blog-wide capabilities
  * @param <array> $reqd_caps : primitive capabilities being tested / requested
  * @param <array> $args = array:
  * 				 $args[0] = original capability requirement passed to current_user_can (possibly a meta cap)
  * 				 $args[1] = user being tested
  * 				 $args[2] = object id (could be a postID, linkID, catID or something else)
  * @return <array> capabilities as array key
  */
 function page_cap($nxt_blogcaps, $reqd_caps, $args)
 {
     static $busy;
     if (!empty($busy)) {
         // don't process recursively
         return $nxt_blogcaps;
     }
     $busy = true;
     // Note: add edit_private_pages if you want the edit_wiki cap to satisfy that check also.
     if (!array_diff($reqd_caps, array('edit_pages', 'edit_others_pages', 'edit_published_pages'))) {
         // determine page ID
         if (!empty($args[2])) {
             $page_id = $args[2];
         } elseif (!empty($_GET['post'])) {
             $page_id = $_GET['post'];
         } elseif (!empty($_POST['ID'])) {
             $page_id = $_POST['ID'];
         } elseif (!empty($_POST['post_ID'])) {
             $page_id = $_POST['post_ID'];
         } elseif (!is_admin()) {
             global $nxt_query;
             if (!empty($nxt_query->post->ID)) {
                 $page_id = $nxt_query->post->ID;
             }
         }
         if (!empty($page_id)) {
             global $current_user, $scoper;
             if (!empty($scoper) && function_exists('is_administrator_rs') && !is_administrator_rs() && $scoper->cap_defs->is_member('edit_wiki')) {
                 // call Role Scoper has_cap filter directly because recursive calling of has_cap filter confuses nxt
                 $user_caps = $scoper->cap_interceptor->flt_user_has_cap($current_user->allcaps, array('edit_wiki'), array('edit_wiki', $current_user->ID, $page_id));
             } else {
                 $user_caps = $current_user->allcaps;
             }
             if (!empty($user_caps['edit_wiki'])) {
                 // Static-buffer the metadata to avoid performance toll from multiple cap checks.
                 static $nxtsc_members_data;
                 if (!isset($nxtsc_members_data)) {
                     $nxtsc_members_data = array();
                 }
                 // If the page in question is a wiki page, give current user credit for all page edit caps.
                 if (is_array($nxtsc_members_data) && wiki_back_compat('check_no_post', $page_id)) {
                     $nxt_blogcaps = array_merge($nxt_blogcaps, array_fill_keys($reqd_caps, true));
                 }
             }
         }
     }
     $busy = false;
     return $nxt_blogcaps;
 }

function user_can_edit_blogwide_rs($src_name = '', $object_type = '', $args = array())
{
    if (is_administrator_rs($src_name)) {
        return true;
    }
    global $scoper, $current_rs_user;
    $defaults = array('require_others_cap' => false, 'status' => '');
    $args = array_merge($defaults, (array) $args);
    extract($args);
    $object_types = $object_type ? (array) $object_type : array_diff(get_post_types(array('public' => true)), array('attachment'));
    foreach ($object_types as $object_type) {
        $cap_defs = $scoper->cap_defs->get_matching($src_name, $object_type, OP_EDIT_RS, '', !$require_others_cap);
        if ($status) {
            $cap_defs = array_merge($cap_defs, $scoper->cap_defs->get_matching($src_name, $object_type, OP_EDIT_RS, $status, !$require_others_cap));
        }
        foreach (array_keys($current_rs_user->blog_roles[ANY_CONTENT_DATE_RS]) as $role_handle) {
            if (isset($scoper->role_defs->role_caps[$role_handle])) {
                if (!array_diff_key($cap_defs, $scoper->role_defs->role_caps[$role_handle])) {
                    return true;
                }
            }
        }
    }
}

 $assignment_list = array();
 foreach ($role_bases as $role_basis) {
     if (is_array($blog_roles[$role_basis]) && isset($blog_roles[$role_basis][$role_handle])) {
         $assignment_names = array_intersect_key($agent_names[$role_basis], $blog_roles[$role_basis][$role_handle]);
         $assignment_list[$role_basis] = "<span class='{$role_basis}-csv'>" . $agent_list_prefix[$role_basis] . ScoperAdminBulkLib::role_assignment_list($blog_roles[$role_basis][$role_handle], $assignment_names, $role_basis) . '</span>';
     }
 }
 $assignment_list = implode('&nbsp;&nbsp;', $assignment_list);
 // retain previous selections in case of error ( user forgets to select groups/users )
 $val = $role_codes[$role_handle];
 $id = "{$role_handle}";
 $checked = $err && isset($_POST['roles']) && in_array($val, $_POST['roles']) ? 'checked="checked"' : '';
 $skip_if_val = REMOVE_ASSIGNMENT_RS;
 // Does current user have this role blog-wide?
 $is_admin_module = isset($otype_source[$object_type]) ? $otype_source[$object_type] : '';
 if (is_administrator_rs($is_admin_module, 'user') || array_intersect_key(array($role_handle => 1), $current_rs_user->blog_roles[$date_key])) {
     $checked = $err && isset($_POST['roles']) && in_array($val, $_POST['roles']) ? 'checked="checked"' : '';
     $skip_if_val = REMOVE_ASSIGNMENT_RS;
     $js_call = "agp_uncheck('" . implode(',', array_keys($roles)) . "',this.id,'assign_for','{$skip_if_val}');";
     $checkbox = "<input type='checkbox' name='roles[]' id='{$id}' value='{$val}' {$checked} onclick=\"{$js_call}\" />";
     $label = "<label for='{$id}'>" . str_replace(' ', '&nbsp;', $scoper->role_defs->get_display_name($role_handle)) . "</label>";
 } else {
     $checkbox = '';
     $label = str_replace(' ', '&nbsp;', $scoper->role_defs->get_display_name($role_handle));
 }
 if (!isset($blog_roles[ROLE_BASIS_USER][$role_handle]) && !isset($blog_roles[ROLE_BASIS_GROUPS][$role_handle])) {
     $role_class = " no-role";
 } elseif (!isset($blog_roles[ROLE_BASIS_USER][$role_handle])) {
     $role_class = " no-user";
 } elseif (!isset($blog_roles[ROLE_BASIS_GROUPS][$role_handle])) {
     $role_class = " no-groups";

 function restrict_roles($scope, $src_or_tx_name, $item_id, $roles, $args = array())
 {
     $defaults = array('implicit_removal' => false, 'is_auto_insertion' => false, 'force_flush' => false);
     $args = array_merge($defaults, (array) $args);
     extract($args);
     global $wpdb;
     $is_administrator = is_administrator_rs($src_or_tx_name, 'user');
     $delete_reqs = array();
     $role_change = false;
     $default_strict_modes = array(false);
     $strict_role_in = '';
     // for object restriction, handle auto-setting of equivalent object roles ( 'post reader' for 'private post reader', 'post author' for 'post editor' ).  There is no logical distinction between these roles where a single object is concerned.
     if (OBJECT_SCOPE_RS == $scope) {
         foreach (array_keys($roles) as $role_handle) {
             $equiv_role_handles = array();
             if ($objscope_equivalents = $this->scoper->role_defs->member_property($role_handle, 'objscope_equivalents')) {
                 foreach ($objscope_equivalents as $equiv_role_handle) {
                     if (!isset($roles[$equiv_role_handle])) {
                         // if the equiv role was set manually, leave it alone.  This would not be normal RS behavior
                         $roles[$equiv_role_handle] = $roles[$role_handle];
                     }
                 }
             }
         }
     }
     if ($item_id) {
         $default_restrictions = $this->scoper->get_default_restrictions($scope);
         $default_strict_roles = !empty($default_restrictions[$src_or_tx_name]) ? array_keys($default_restrictions[$src_or_tx_name]) : array();
         if ($default_strict_roles) {
             $strict_role_in = "'" . implode("', '", scoper_role_handles_to_names($default_strict_roles)) . "'";
             $default_strict_modes[] = true;
         }
     }
     foreach ($default_strict_modes as $default_strict) {
         $stored_reqs = array();
         $req_ids = array();
         if ($default_strict && $strict_role_in) {
             $role_clause = "AND role_name IN ({$strict_role_in})";
         } elseif ($strict_role_in) {
             $role_clause = "AND role_name NOT IN ({$strict_role_in})";
         } else {
             $role_clause = '';
         }
         // IMPORTANT: max_scope value determines whether we are inserting / updating RESTRICTIONS or UNRESTRICTIONS
         if (TERM_SCOPE_RS == $scope) {
             $query_max_scope = $default_strict ? 'blog' : 'term';
         } else {
             $query_max_scope = $default_strict ? 'blog' : 'object';
         }
         // Storage of 'blog' max_scope as object restriction does not eliminate any term restrictions.  It merely indicates, for data sources that are default strict, that this object does not restrict roles
         $qry = "SELECT requirement_id AS assignment_id, require_for AS assign_for, inherited_from, role_name FROM {$wpdb->role_scope_rs} WHERE topic = %s AND max_scope = %s" . " AND src_or_tx_name = %s AND obj_or_term_id = %d AND role_type = 'rs' {$role_clause}";
         if ($results = scoper_get_results($wpdb->prepare($qry, $scope, $query_max_scope, $src_or_tx_name, $item_id))) {
             foreach ($results as $key => $req) {
                 $role_handle = 'rs_' . $req->role_name;
                 if (OBJECT_SCOPE_RS == $scope && isset($is_objscope_equiv[$role_handle])) {
                     $role_handle = $is_objscope_equiv[$role_handle];
                 }
                 $stored_reqs[$role_handle] = array('assignment_id' => $req->assignment_id, 'assign_for' => $req->assign_for, 'inherited_from' => $req->inherited_from);
                 $req_ids[$role_handle][$req->assignment_id] = array();
             }
         }
         if (!$is_administrator) {
             $user_has_role = $this->_validate_assigner_roles($scope, $src_or_tx_name, $item_id, $roles);
         }
         if ($implicit_removal) {
             // Stored restrictions which are not mirrored in $roles will be deleted (along with their prodigy)
             foreach (array_keys($stored_reqs) as $role_handle) {
                 $max_scope = isset($roles[$role_handle]['max_scope']) ? $roles[$role_handle]['max_scope'] : false;
                 if ($max_scope != $query_max_scope) {
                     $delete_reqs = $delete_reqs + $req_ids[$role_handle];
                 }
             }
         }
         foreach ($roles as $role_handle => $setting) {
             if (!$is_administrator && empty($user_has_role[$role_handle])) {
                 continue;
             }
             if ($default_strict && !in_array($role_handle, $default_strict_roles)) {
                 continue;
             }
             if (!$default_strict && !empty($default_strict_roles) && in_array($role_handle, $default_strict_roles)) {
                 continue;
             }
             $max_scope = $setting['max_scope'];
             if ($max_scope != $query_max_scope) {
                 $require_for = REMOVE_ASSIGNMENT_RS;
             } elseif ($setting['for_item']) {
                 $require_for = $setting['for_children'] ? ASSIGN_FOR_BOTH_RS : ASSIGN_FOR_ENTITY_RS;
             } else {
                 $require_for = $setting['for_children'] ? ASSIGN_FOR_CHILDREN_RS : REMOVE_ASSIGNMENT_RS;
             }
             $update_require_for = array(ASSIGN_FOR_ENTITY_RS => array(), ASSIGN_FOR_CHILDREN_RS => array(), ASSIGN_FOR_BOTH_RS => array());
             $stored_req = isset($stored_reqs[$role_handle]) ? $stored_reqs[$role_handle] : array();
             $unused_byref_arg = '';
             $comparison = $this->_compare_role_settings($require_for, $stored_req, $delete_reqs, $update_require_for, $unused_byref_arg, $unused_byref_arg);
             $insert_restriction = $comparison['unset'] ? false : $require_for;
             // Mark assignment for propagation to child items (But don't do so on storage of default restriction to root item. Default restrictions are only applied at item creation.)
             $propagate_restriction = $item_id && isset($comparison['new_propagation']) ? $comparison['new_propagation'] : '';
             if ($comparison['role_change']) {
                 $role_change = true;
//.........这里部分代码省略.........

    function item_tree($scope, $mode, $src, $otype_or_tx, $all_items, $assigned_roles, $strict_items, $role_defs_by_otype, $role_codes, $args = array())
    {
        $defaults = array('admin_items' => '', 'editable_roles' => '', 'ul_class' => 'rs-termlist', 'ie_link_style' => '', 'object_names' => '', 'table_captions' => '', 'err' => '', 'object_status' => '', 'agent_caption_plural' => '', 'agent_list_prefix' => '', 'agent_names' => '', 'default_hide_empty' => false, 'role_bases' => array(ROLE_BASIS_USER, ROLE_BASIS_GROUPS), 'single_item' => false);
        $args = array_merge($defaults, (array) $args);
        extract($args);
        global $scoper;
        if (!is_object($src)) {
            $src = $scoper->data_sources->get($src);
        }
        $col_id = $src->cols->id;
        $col_name = $src->cols->name;
        $col_parent = isset($src->cols->parent) ? $src->cols->parent : '';
        $item_label = $otype_or_tx->labels->singular_name;
        if (TERM_SCOPE_RS == $scope) {
            $src_or_tx_name = $otype_or_tx->name;
            $edit_url_base = !empty($otype_or_tx->edit_url) ? $otype_or_tx->edit_url : '';
        } else {
            $src_or_tx_name = $src->name;
            $edit_url_base = !empty($src->edit_url) ? $src->edit_url : '';
        }
        if ($default_hide_empty) {
            $hide_tr_sfx = '-hide';
            $hide_li_sfx = '-hide';
        } else {
            $hide_tr_sfx = '';
            $hide_li_sfx = '';
        }
        $nextlink = '';
        $prevlink = '';
        if (empty($admin_items)) {
            $admin_items = array();
        }
        if (empty($agent_caption_plural)) {
            $agent_caption_plural = __('Users or Groups', 'scoper');
        }
        if (empty($agent_list_prefix)) {
            $agent_list_prefix = array();
            $agent_list_prefix[ROLE_BASIS_USER] = '';
            $agent_list_prefix[ROLE_BASIS_GROUPS] = __('Groups') . ': ';
        }
        static $prevtext, $nexttext, $is_administrator, $role_header, $agents_header;
        if (empty($prevtext)) {
            // buffer prev/next caption for display with each term
            //$prevtext = _ x('prev', '|abbreviated link to previous item', 'scoper');
            //$nexttext = _ x('next', '|abbreviated link to next item', 'scoper');
            $prevtext = __('prev', 'scoper');
            $nexttext = __('next', 'scoper');
            $is_administrator = is_administrator_rs($src, 'user');
            $role_header = __awp('Role');
            switch ($mode) {
                case ROLE_ASSIGNMENT_RS:
                    //$agents_header = sprintf( _ x('Current %s', 'users or groups', 'scoper'), $agent_caption_plural);
                    $agents_header = sprintf(__('Current %s', 'scoper'), $agent_caption_plural);
                    break;
                case ROLE_RESTRICTION_RS:
                    $agents_header = __('Current Restrictions', 'scoper');
                    break;
                default:
                    return;
            }
        }
        // disregard roles that don't apply to this scope
        foreach ($role_defs_by_otype as $object_type => $role_defs) {
            foreach ($role_defs as $role_handle => $role) {
                if (!isset($role->valid_scopes[$scope])) {
                    unset($role_defs_by_otype[$object_type][$role_handle]);
                }
            }
        }
        // for object scope, assign "private post reader" role, but label it as "post reader" to limit confusion
        $role_display_name = array();
        foreach ($role_defs_by_otype as $role_defs) {
            foreach (array_keys($role_defs) as $role_handle) {
                $role_display_name[$role_handle] = $scoper->role_defs->get_display_name($role_handle, $scope . '_ui');
            }
        }
        // display a separate role assignment list for each individual term / object
        $last_id = -1;
        $last_name = '';
        $last_parent_id = -1;
        $parent_id = 0;
        $parents = array();
        $depth = 0;
        $_top_link = "<a{$ie_link_style} href='#scoper_top'>" . __('top', 'scoper') . '</a>';
        $tr_display = strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== false ? 'block' : 'table-row';
        $show_all_caption = __('show all', 'scoper');
        echo "<ul class='{$ul_class}' style='padding-left:0.1em;'>";
        if (empty($all_items)) {
            $all_items = array();
        }
        if (!$single_item && is_user_administrator_rs() && 'nav_menu' != $src_or_tx_name) {
            // TODO: action handler for new menu item storage
            if (ROLE_ASSIGNMENT_RS == $mode) {
                $root_caption = sprintf(__('DEFAULTS for new %s', 'scoper'), $otype_or_tx->labels->name);
            } else {
                $root_caption = sprintf(__('DEFAULTS for all %s', 'scoper'), $otype_or_tx->labels->name);
            }
            if (TERM_SCOPE_RS == $scope) {
                $root_item = (object) array($col_id => 0, $col_name => $root_caption, $col_parent => 0);
                array_unshift($all_items, $root_item);
//.........这里部分代码省略.........

function scoper_admin_section_restrictions($taxonomy)
{
    global $scoper, $scoper_admin;
    $tx = $scoper->taxonomies->get($taxonomy);
    if (empty($tx) || empty($tx->requires_term)) {
        wp_die(__('Invalid taxonomy', 'scoper'));
    }
    $is_administrator = is_administrator_rs($tx, 'user');
    if (!$scoper_admin->user_can_admin_terms($taxonomy)) {
        wp_die(__awp('Cheatin’ uh?'));
    }
    require_once dirname(__FILE__) . '/admin-bulk_rs.php';
    $role_assigner = init_role_assigner();
    $nonce_id = 'scoper-assign-roles';
    $role_codes = ScoperAdminBulk::get_role_codes();
    echo '<a name="scoper_top"></a>';
    // retrieve all terms to track hierarchical relationship, even though some may not be adminable by current user
    $val = ORDERBY_HIERARCHY_RS;
    $args = array('order_by' => $val);
    $all_terms = $scoper->get_terms($taxonomy, UNFILTERED_RS, COLS_ALL_RS, 0, $args);
    // =========================== Submission Handling =========================
    if (isset($_POST['rs_submit'])) {
        $err = ScoperAdminBulk::role_submission(TERM_SCOPE_RS, ROLE_RESTRICTION_RS, '', $taxonomy, $role_codes, '', $nonce_id);
        if (scoper_get_option('file_filtering')) {
            scoper_flush_file_rules();
        }
    } else {
        $err = 0;
    }
    // =========================== Prepare Data ===============================
    $tx_src = $scoper->data_sources->get($tx->source);
    if ($col_id = $tx_src->cols->id) {
        // determine which terms current user can admin
        if ($admin_terms = $scoper->get_terms($taxonomy, ADMIN_TERMS_FILTER_RS, COL_ID_RS)) {
            $admin_terms = array_fill_keys($admin_terms, true);
        }
    } else {
        $admin_terms = array();
    }
    // =========================== Display UI ===============================
    ?>


<div class="wrap agp-width97">
<?php 
    $tx_label = $tx->labels->singular_name;
    $src_label = $scoper->data_sources->member_property($tx->object_source, 'labels', 'singular_name');
    echo '<h2>' . sprintf(__('%s Restrictions', 'scoper'), $tx_label);
    echo '&nbsp;&nbsp;<span style="font-size: 0.6em; font-style: normal">(<a href="#scoper_notes">' . __('see notes', 'scoper') . '</a>)</span></h2>';
    if (scoper_get_option('display_hints')) {
        echo '<div class="rs-hint">';
        if ('category' == $taxonomy && scoper_get_otype_option('use_object_roles', 'post', 'post')) {
            printf(__('Reduce access by requiring some role(s) to be %1$s%2$s-assigned%3$s (or %4$s-assigned). Corresponding General Roles (whether assigned by WordPress or Role Scoper) are ignored.', 'scoper'), "<a href='admin.php?page=rs-{$taxonomy}-roles_t'>", $tx_label, '</a>', $src_label);
        } else {
            printf(__('Reduce access by requiring some role(s) to be %1$s%2$s-assigned%3$s. Corresponding General Role assignments are ignored.', 'scoper'), "<a href='admin.php?page=rs-{$taxonomy}-roles_t'>", $tx_label, '</a>');
        }
        echo '</div>';
    }
    if (!($role_defs_by_otype = $scoper->role_defs->get_for_taxonomy($tx->object_source, $taxonomy))) {
        echo '<br />' . sprintf(__('Role definition error (taxonomy: %s).', 'scoper'), $taxonomy);
        echo '</div>';
        return;
    }
    if (empty($admin_terms)) {
        echo '<br />' . sprintf(__('Either you do not have permission to administer any %s, or none exist.', 'scoper'), $tx->labels->name);
        echo '</div>';
        return;
    }
    ?>

<form action="" method="post" name="role_scope" id="role_assign">
<?php 
    wp_nonce_field($nonce_id);
    echo '<br /><div id="rs-term-scroll-links">';
    echo ScoperAdminBulkLib::taxonomy_scroll_links($tx, $all_terms, $admin_terms);
    echo '</div><hr />';
    // ============ Assignment Mode Selection Display ================
    // TODO: is Link Category label handled without workaround now?
    $tx_label = agp_strtolower($tx->labels->name);
    $tx_label_singular = agp_strtolower($tx->labels->singular_name);
    $parent_col = $tx_src->cols->parent;
    if (!$parent_col || !empty($tx->uses_standard_schema) && empty($tx->hierarchical)) {
        $assignment_modes = array(ASSIGN_FOR_ENTITY_RS => sprintf(__('for selected %s', 'scoper'), $tx_label));
    } else {
        $assignment_modes = array(ASSIGN_FOR_ENTITY_RS => sprintf(__('for selected %s', 'scoper'), $tx_label), ASSIGN_FOR_CHILDREN_RS => sprintf(__('for sub-%s of selected', 'scoper'), $tx_label), ASSIGN_FOR_BOTH_RS => sprintf(__('for selected and sub-%s', 'scoper'), $tx_label));
    }
    $max_scopes = array('term' => __('Restrict selected roles', 'scoper'), 'blog' => __('Unrestrict selected roles', 'scoper'));
    $args = array('max_scopes' => $max_scopes, 'scope' => TERM_SCOPE_RS);
    ScoperAdminBulk::display_inputs(ROLE_RESTRICTION_RS, $assignment_modes, $args);
    ScoperAdminBulk::item_tree_jslinks(ROLE_RESTRICTION_RS);
    // IE (6 at least) won't obey link color directive in a.classname CSS
    $ie_link_style = strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== false ? ' style="color:white;"' : '';
    $args = array('include_child_restrictions' => true, 'return_array' => true, 'role_type' => 'rs', 'force_refresh' => true);
    $strict_terms = $scoper->get_restrictions(TERM_SCOPE_RS, $taxonomy, $args);
    //strict_terms[taxonomy][role name][term_id] = array: terms which require Role Scoper assignment for specified role (user blog roles ignored, required caps may be supplied by scoper term role or object-specific assignment)
    // (for other terms, Role Scoper role assignment is optional (term role assignments will supplement blog caps)
    $editable_roles = array();
    foreach ($all_terms as $term) {
        $id = $term->{$col_id};
        foreach ($role_defs_by_otype as $object_type => $role_defs) {
//.........这里部分代码省略.........

function is_content_administrator_rs($user = '')
{
    return is_administrator_rs('', 'content', $user);
}

 function user_can_edit_blogwide($src_name = '', $object_type = '', $args = '')
 {
     if (is_administrator_rs($src_name)) {
         return true;
     }
     require_once dirname(__FILE__) . '/admin/permission_lib_rs.php';
     return user_can_edit_blogwide_rs($src_name, $object_type, $args);
 }

function scoper_admin_object_restrictions($src_name, $object_type)
{
    global $scoper, $scoper_admin;
    if (!($src = $scoper->data_sources->get($src_name)) || !empty($src->no_object_roles) || !empty($src->taxonomy_only) || $src_name == 'group') {
        wp_die(__('Invalid data source', 'scoper'));
    }
    $is_administrator = is_administrator_rs($src, 'user');
    $role_bases = array();
    if (USER_ROLES_RS && ($is_administrator || $scoper_admin->user_can_admin_object($src_name, $object_type, 0, true))) {
        $role_bases[] = ROLE_BASIS_USER;
    }
    if (GROUP_ROLES_RS && ($is_administrator || $scoper_admin->user_can_admin_object($src_name, $object_type, 0, true) || current_user_can('manage_groups'))) {
        $role_bases[] = ROLE_BASIS_GROUPS;
    }
    if (empty($role_bases)) {
        wp_die(__awp('Cheatin’ uh?'));
    }
    $otype = $scoper->data_sources->member_property($src_name, 'object_types', $object_type);
    require_once dirname(__FILE__) . '/admin-bulk_rs.php';
    require_once dirname(__FILE__) . '/admin_lib-bulk-parent_rs.php';
    $role_assigner = init_role_assigner();
    $nonce_id = 'scoper-assign-roles';
    $role_codes = ScoperAdminBulk::get_role_codes();
    echo '<a name="scoper_top"></a>';
    // ==== Process Submission =====
    $err = 0;
    if (isset($_POST['rs_submit'])) {
        $err = ScoperAdminBulk::role_submission(OBJECT_SCOPE_RS, ROLE_RESTRICTION_RS, '', $src_name, $role_codes, '', $nonce_id);
        if (scoper_get_option('file_filtering')) {
            scoper_flush_file_rules();
        }
    }
    ?>


<div class="wrap agp-width97">
<?php 
    $src_otype = isset($src->object_types) ? "{$src_name}:{$object_type}" : $src_name;
    $item_label_singular = $scoper_admin->interpret_src_otype($src_otype, 'singular_name');
    $item_label = $scoper_admin->interpret_src_otype($src_otype);
    echo '<h2>' . sprintf(__('%s Restrictions', 'scoper'), $item_label_singular) . '&nbsp;&nbsp;<span style="font-size: 0.6em; font-style: normal">(<a href="#scoper_notes">' . __('see notes', 'scoper') . '</a>)</span>' . '</h2>';
    if (scoper_get_option('display_hints')) {
        echo '<div class="rs-hint">';
        $link_open = "<a href='admin.php?page=rs-{$object_type}-roles'>";
        $uses_taxonomies = scoper_get_taxonomy_usage($src_name, $object_type);
        if ($uses_taxonomies && 1 == count($uses_taxonomies)) {
            $tx_display = $scoper->taxonomies->member_property(reset($uses_taxonomies), 'display_name');
            printf(__('Reduce access to a specific %1$s by requiring some role(s) to be %2$s%3$s-assigned%4$s. Corresponding WP-assigned Roles and RS-assigned General and %5$s Role assignments are ignored.', 'scoper'), $item_label_singular, $link_open, $item_label_singular, '</a>', $tx_display);
        } elseif (count($uses_taxonomies)) {
            printf(__('Reduce access to a specific %1$s by requiring some role(s) to be %2$s%3$s-assigned%4$s. Corresponding WP-assigned Roles and RS-assigned General and Term Role assignments are ignored.', 'scoper'), $item_label_singular, $link_open, $item_label_singular, '</a>');
        } else {
            printf(__('Reduce access to a specific %1$s by requiring some role(s) to be %2$s%3$s-assigned%4$s. Corresponding WP-assigned Roles and RS-assigned General Role assignments are ignored.', 'scoper'), $item_label_singular, $link_open, $item_label_singular, '</a>');
        }
        echo '</div>';
    }
    $ignore_hierarchy = !empty($otype->ignore_object_hierarchy);
    ?>


<form action="" method="post" name="role_assign" id="role_assign">
<?php 
    wp_nonce_field($nonce_id);
    // ============ Users / Groups and Assignment Mode Selection Display ================
    if (empty($src->cols->parent) || $ignore_hierarchy) {
        $assignment_modes = array(ASSIGN_FOR_ENTITY_RS => sprintf(__('for selected %s', 'scoper'), $item_label));
    } else {
        $assignment_modes = array(ASSIGN_FOR_ENTITY_RS => sprintf(__('for selected %s', 'scoper'), $item_label), ASSIGN_FOR_CHILDREN_RS => sprintf(__('for sub-%s of selected', 'scoper'), $item_label), ASSIGN_FOR_BOTH_RS => sprintf(__('for selected and sub-%s', 'scoper'), $item_label));
    }
    $max_scopes = array('object' => __('Restrict selected roles', 'scoper'), 'blog' => __('Unrestrict selected roles', 'scoper'));
    $args = array('max_scopes' => $max_scopes, 'scope' => OBJECT_SCOPE_RS);
    ScoperAdminBulk::display_inputs(ROLE_RESTRICTION_RS, $assignment_modes, $args);
    echo '<br />';
    $args = array('default_hide_empty' => !empty($otype->admin_default_hide_empty), 'hide_roles' => true, 'scope' => OBJECT_SCOPE_RS, 'src' => $src, 'otype' => $otype);
    ScoperAdminBulk::item_tree_jslinks(ROLE_RESTRICTION_RS, $args);
    // buffer prev/next caption for display with each obj type
    //$prevtext = _ x('prev', 'abbreviated link to previous item', 'scoper');
    //$nexttext = _ x('next', 'abbreviated link to next item', 'scoper');
    $prevtext = __('prev', 'scoper');
    $nexttext = __('next', 'scoper');
    $site_url = get_option('siteurl');
    $args = array('include_child_restrictions' => true, 'return_array' => true, 'role_type' => 'rs', 'force_refresh' => true);
    $strict_objects = $scoper->get_restrictions(OBJECT_SCOPE_RS, $src_name, $args);
    $object_names = array();
    $object_status = array();
    $listed_objects = array();
    $unlisted_objects = array();
    $col_id = $src->cols->id;
    $col_parent = isset($src->cols->parent) && !$ignore_hierarchy ? $src->cols->parent : '';
    $object_ids = array();
    if (isset($strict_objects['restrictions'])) {
        foreach (array_keys($strict_objects['restrictions']) as $role_handle) {
            $object_ids = $object_ids + array_keys($strict_objects['restrictions'][$role_handle]);
        }
    } elseif (isset($strict_objects['unrestrictions'])) {
        foreach (array_keys($strict_objects['unrestrictions']) as $role_handle) {
            $object_ids = $object_ids + array_keys($strict_objects['unrestrictions'][$role_handle]);
        }
    }
    $object_ids = array_flip(array_unique($object_ids));
    // Get the obj name, parent associated with each role (also sets $object_names, $unlisted objects)
//.........这里部分代码省略.........

 function build_menu()
 {
     if (strpos($_SERVER['REQUEST_URI'], 'wp-admin/network/')) {
         return;
     }
     global $plugin_page_cr;
     if (!defined('USER_ROLES_RS') && isset($_POST['enable_group_roles'])) {
         scoper_use_posted_init_options();
     }
     global $current_user;
     $is_option_administrator = is_option_administrator_rs();
     $is_user_administrator = is_user_administrator_rs();
     $is_content_administrator = is_content_administrator_rs();
     /*
     // optional hack to prevent roles / restrictions menu for non-Administrators
     //
     // This is now handled as a Role Scoper Option.
     // In Roles > Options > Features > Content Maintenance, set "Roles and Restrictions can be set" to "Administrators only" 
     //
     // To prevent Role Scoper from filtering the backend at all, go to Roles > Options > Realm > Access Types and deselect "editing and administering content"
     //
     // end optional hack
     */
     $require_blogwide_editor = scoper_get_option('role_admin_blogwide_editor_only');
     if (!$is_content_administrator && 'admin_content' == $require_blogwide_editor) {
         if (!$is_option_administrator) {
             return;
         }
     }
     if (!$is_user_administrator && 'admin' == $require_blogwide_editor) {
         if (!$is_option_administrator) {
             return;
         }
     }
     $can_admin_objects = array();
     $can_admin_terms = array();
     $use_post_types = scoper_get_option('use_post_types');
     $use_taxonomies = scoper_get_option('use_taxonomies');
     // which object types does this user have any administration over?
     foreach ($this->scoper->data_sources->get_all() as $src_name => $src) {
         if (!empty($src->no_object_roles) || !empty($src->taxonomy_only) || 'group' == $src_name) {
             continue;
         }
         $object_types = isset($src->object_types) ? $src->object_types : array($src_name => true);
         foreach (array_keys($object_types) as $object_type) {
             if ('post' == $src_name && empty($use_post_types[$object_type])) {
                 continue;
             }
             if (is_administrator_rs($src, 'user') || $this->user_can_admin_object($src_name, $object_type, 0, true)) {
                 if (scoper_get_otype_option('use_object_roles', "{$src_name}:{$object_type}")) {
                     $can_admin_objects[$src_name][$object_type] = true;
                 }
             }
         }
     }
     // which taxonomies does this user have any administration over?
     foreach ($this->scoper->taxonomies->get_all() as $taxonomy => $tx) {
         if (taxonomy_exists($taxonomy) && empty($use_taxonomies[$taxonomy]) && 'post' == $tx->object_source) {
             continue;
         }
         if (is_taxonomy_used_rs($taxonomy) && (is_administrator_rs($tx->source, 'user') || $this->user_can_admin_terms($taxonomy))) {
             $can_admin_terms[$taxonomy] = true;
         }
     }
     // Users Tab
     if (DEFINE_GROUPS_RS) {
         $can_manage_groups = DEFINE_GROUPS_RS && ($is_user_administrator || current_user_can('recommend_group_membership'));
         $cap_req = $can_manage_groups ? 'read' : 'manage_groups';
         $groups_caption = defined('GROUPS_CAPTION_RS') ? GROUPS_CAPTION_RS : __('Role Groups', 'scoper');
         if (!IS_MU_RS || !scoper_get_site_option('mu_sitewide_groups')) {
             add_submenu_page('users.php', $groups_caption, $groups_caption, $cap_req, 'rs-groups', array(&$this, 'menu_handler'));
         } elseif (IS_MU_RS && !awp_ver('3.1')) {
             add_submenu_page("ms-admin.php", $groups_caption, $groups_caption, $cap_req, 'rs-groups', array(&$this, 'menu_handler'));
         }
         // satisfy WordPress' demand that all admin links be properly defined in menu
         if ('rs-default_groups' == $plugin_page_cr) {
             add_submenu_page('users.php', __('User Groups', 'scoper'), __('Default Groups', 'scoper'), $cap_req, 'rs-default_groups', array(&$this, 'menu_handler'));
         }
         if ('rs-group_members' == $plugin_page_cr) {
             add_submenu_page('users.php', __('User Groups', 'scoper'), __('Group Members', 'scoper'), $cap_req, 'rs-group_members', array(&$this, 'menu_handler'));
         }
     }
     // the rest of this function pertains to Roles and Restrictions menus
     if (!$is_user_administrator && !$can_admin_terms && !$is_user_administrator && !$can_admin_objects) {
         return;
     }
     $general_roles = $is_user_administrator;
     // && scoper_get_option('rs_blog_roles');  // rs_blog_roles option has never been active in any RS release; leave commented here in case need arises
     // determine the official WP-registered URL for roles and restrictions menus
     $object_submenus_first = false;
     $use_users_menu = defined('OZH_MENU_VER') && !defined('SCOPER_FORCE_ROLES_MENU') || defined('SCOPER_FORCE_USERS_MENU');
     $tweak_menu = false;
     if ($use_users_menu) {
         $roles_menu = 'users.php';
         $restrictions_menu = 'users.php';
         if ($is_option_administrator) {
             add_submenu_page($roles_menu, __('Role Options', 'scoper'), __('Role Options', 'scoper'), 'read', 'rs-options', array(&$this, 'menu_handler'));
         }
     } else {
         if (!empty($can_admin_terms['category'])) {
//.........这里部分代码省略.........

function scoper_admin_section_roles($taxonomy)
{
    global $scoper, $scoper_admin, $wpdb;
    if (!($tx = $scoper->taxonomies->get($taxonomy))) {
        wp_die(__('Invalid taxonomy', 'scoper'));
    }
    $is_administrator = is_administrator_rs($tx, 'user');
    $role_bases = array();
    if (USER_ROLES_RS && ($is_administrator || $scoper_admin->user_can_admin_terms($taxonomy))) {
        $role_bases[] = ROLE_BASIS_USER;
    }
    if (GROUP_ROLES_RS && ($is_administrator || $scoper_admin->user_can_admin_terms($taxonomy) || current_user_can('manage_groups'))) {
        $role_bases[] = ROLE_BASIS_GROUPS;
    }
    if (empty($role_bases)) {
        wp_die(__awp('Cheatin’ uh?'));
    }
    require_once dirname(__FILE__) . '/admin-bulk_rs.php';
    require_once dirname(__FILE__) . '/role_assignment_lib_rs.php';
    $role_assigner = init_role_assigner();
    $nonce_id = 'scoper-assign-roles';
    $agents = ScoperAdminBulk::get_agents($role_bases);
    $agent_names = ScoperAdminBulk::agent_names($agents);
    $agent_list_prefix = ScoperAdminBulk::agent_list_prefixes();
    $agent_caption_plural = ScoperAdminBulk::agent_captions_plural($role_bases);
    $role_bases = array_keys($agents);
    $role_codes = ScoperAdminBulk::get_role_codes();
    echo '<a name="scoper_top"></a>';
    // retrieve all terms to track hierarchical relationship, even though some may not be adminable by current user
    $val = ORDERBY_HIERARCHY_RS;
    $args = array('order_by' => $val);
    $all_terms = $scoper->get_terms($taxonomy, UNFILTERED_RS, COLS_ALL_RS, 0, $args);
    // =========================== Submission Handling =========================
    if (isset($_POST['rs_submit'])) {
        $err = ScoperAdminBulk::role_submission(TERM_SCOPE_RS, ROLE_ASSIGNMENT_RS, $role_bases, $taxonomy, $role_codes, $agent_caption_plural, $nonce_id);
    } else {
        $err = 0;
    }
    // =========================== Prepare Data ===============================
    //$term_roles [role_basis] [src_name] [object_id] [role_handle] [agent_id] = array( 'assign_for' => ENUM , 'inherited_from' => assignment_id)
    $term_roles = array();
    foreach ($role_bases as $role_basis) {
        $term_roles[$role_basis] = ScoperRoleAssignments::get_assigned_roles(TERM_SCOPE_RS, $role_basis, $taxonomy);
    }
    $tx_src = $scoper->data_sources->get($tx->source);
    if ($col_id = $tx_src->cols->id) {
        // determine which terms current user can admin
        if ($admin_terms = $scoper->get_terms($taxonomy, ADMIN_TERMS_FILTER_RS, COL_ID_RS)) {
            $admin_terms = array_fill_keys($admin_terms, true);
        }
    } else {
        $admin_terms = array();
    }
    // =========================== Display UI ===============================
    ?>

<div class="wrap agp-width97" id="rs_admin_wrap">
<?php 
    $tx->labels->singular_name = $tx->labels->singular_name;
    echo '<h2>' . sprintf(__('%s Roles', 'scoper'), $tx->labels->singular_name) . '&nbsp;&nbsp;<span style="font-size: 0.6em; font-style: normal">(<a href="#scoper_notes">' . __('see notes', 'scoper') . '</a>)</span>' . '</h2>';
    if (scoper_get_option('display_hints')) {
        echo '<div class="rs-hint">';
        if (!empty($tx->requires_term)) {
            //printf(_ x('Grant capabilities within a specific %2$s, potentially more than a user\'s WP role would allow. To reduce access, define %1$s%2$s&nbsp;Restrictions%3$s.', 'arguments are link open, taxonomy name, link close', 'scoper'), "<a href='admin.php?page=rs-$taxonomy-restrictions_t'>", $tx->labels->singular_name, '</a>');
            printf(__('Grant capabilities within a specific %2$s, potentially more than a user\'s WP role would allow. To reduce access, define %1$s%2$s&nbsp;Restrictions%3$s.', 'scoper'), "<a href='admin.php?page=rs-{$taxonomy}-restrictions_t'>", $tx->labels->singular_name, '</a>');
        } else {
            printf(__('Grant capabilities within a specific %s, potentially more than a user\'s WP role would allow.', 'scoper'), $tx->labels->singular_name);
        }
        echo '</div>';
    }
    if (!($role_defs_by_otype = $scoper->role_defs->get_for_taxonomy($tx->object_source, $taxonomy))) {
        echo '<br />' . sprintf(__('Role definition error (taxonomy: %s).', 'scoper'), $taxonomy);
        echo '</div>';
        return;
    }
    if (empty($admin_terms)) {
        echo '<br />' . sprintf(__('Either you do not have permission to administer any %s, or none exist.', 'scoper'), $tx->labels->singular_name);
        echo '</div>';
        return;
    }
    ?>

<form action="" method="post" name="role_assign" id="role_assign">
<?php 
    wp_nonce_field($nonce_id);
    echo '<br /><div id="rs-term-scroll-links">';
    echo ScoperAdminBulkLib::taxonomy_scroll_links($tx, $all_terms, $admin_terms);
    echo '</div><hr />';
    // ============ Users / Groups and Assignment Mode Selection Display ================
    $tx_label = agp_strtolower($tx->labels->name);
    $parent_col = !empty($tx_src->cols->parent) ? $tx_src->cols->parent : '';
    if (!$parent_col || !empty($tx->uses_standard_schema) && empty($tx->hierarchical)) {
        $assignment_modes = array(ASSIGN_FOR_ENTITY_RS => __('Assign', 'scoper'), REMOVE_ASSIGNMENT_RS => __('Remove', 'scoper'));
    } else {
        $assignment_modes = array(ASSIGN_FOR_ENTITY_RS => sprintf(__('Assign for selected %s', 'scoper'), $tx_label), ASSIGN_FOR_CHILDREN_RS => sprintf(__('Assign for sub-%s of selected', 'scoper'), $tx_label), ASSIGN_FOR_BOTH_RS => sprintf(__('Assign for selected and sub-%s', 'scoper'), $tx_label), REMOVE_ASSIGNMENT_RS => __('Remove', 'scoper'));
    }
    $args = array('role_bases' => $role_bases, 'agents' => $agents, 'agent_caption_plural' => $agent_caption_plural, 'scope' => TERM_SCOPE_RS, 'src_or_tx_name' => $taxonomy);
    ScoperAdminBulk::display_inputs(ROLE_ASSIGNMENT_RS, $assignment_modes, $args);
    $args = array('role_bases' => $role_bases);
    ScoperAdminBulk::item_tree_jslinks(ROLE_ASSIGNMENT_RS, $args);
//.........这里部分代码省略.........