1<?php
  2/**
  3 * Multisite sites administration panel.
  4 *
  5 * @package WordPress
  6 * @subpackage Multisite
  7 * @since 3.0.0
  8 */
  9
 10/** Load WordPress Administration Bootstrap */
 11require_once __DIR__ . '/admin.php';
 12
 13if ( ! current_user_can( 'manage_sites' ) ) {
 14	wp_die( __( 'Sorry, you are not allowed to access this page.' ), 403 );
 15}
 16
 17$wp_list_table = _get_list_table( 'WP_MS_Sites_List_Table' );
 18$pagenum       = $wp_list_table->get_pagenum();
 19
 20// Used in the HTML title tag.
 21$title       = __( 'Sites' );
 22$parent_file = 'sites.php';
 23
 24add_screen_option( 'per_page' );
 25
 26get_current_screen()->add_help_tab(
 27	array(
 28		'id'      => 'overview',
 29		'title'   => __( 'Overview' ),
 30		'content' =>
 31		'<p>' . __( 'Add Site takes you to the screen for adding a new site to the network. You can search for a site by Name, ID number, or IP address. Screen Options allows you to choose how many sites to display on one page.' ) . '</p>' .
 32		'<p>' . __( 'This is the main table of all sites on this network. Switch between list and excerpt views by using the icons above the right side of the table.' ) . '</p>' .
 33			'<p>' . __( 'Hovering over each site reveals seven options (three for the primary site):' ) . '</p>' .
 34			'<ul><li>' . __( 'An Edit link to a separate Edit Site screen.' ) . '</li>' .
 35			'<li>' . __( 'Dashboard leads to the Dashboard for that site.' ) . '</li>' .
 36			'<li>' . __( 'Flag for Deletion, Archive, and Spam which lead to confirmation screens. These actions can be reversed later.' ) . '</li>' .
 37			'<li>' . __( 'Delete Permanently which is a permanent action after the confirmation screen.' ) . '</li>' .
 38			'<li>' . __( 'Visit to go to the front-end of the live site.' ) . '</li></ul>',
 39	)
 40);
 41
 42get_current_screen()->set_help_sidebar(
 43	'<p><strong>' . __( 'For more information:' ) . '</strong></p>' .
 44	'<p>' . __( '<a href="https://developer.wordpress.org/advanced-administration/multisite/admin/#network-admin-sites-screen">Documentation on Site Management</a>' ) . '</p>' .
 45	'<p>' . __( '<a href="https://wordpress.org/support/forum/multisite/">Support forums</a>' ) . '</p>'
 46);
 47
 48get_current_screen()->set_screen_reader_content(
 49	array(
 50		'heading_pagination' => __( 'Sites list navigation' ),
 51		'heading_list'       => __( 'Sites list' ),
 52	)
 53);
 54
 55$id = isset( $_REQUEST['id'] ) ? (int) $_REQUEST['id'] : 0;
 56
 57if ( isset( $_GET['action'] ) ) {
 58	/** This action is documented in wp-admin/network/edit.php */
 59	do_action( 'wpmuadminedit' );
 60
 61	// A list of valid actions and their associated messaging for confirmation output.
 62	$manage_actions = array(
 63		/* translators: %s: Site URL. */
 64		'activateblog'   => __( 'You are about to remove the deletion flag from the site %s.' ),
 65		/* translators: %s: Site URL. */
 66		'deactivateblog' => __( 'You are about to flag the site %s for deletion.' ),
 67		/* translators: %s: Site URL. */
 68		'unarchiveblog'  => __( 'You are about to unarchive the site %s.' ),
 69		/* translators: %s: Site URL. */
 70		'archiveblog'    => __( 'You are about to archive the site %s.' ),
 71		/* translators: %s: Site URL. */
 72		'unspamblog'     => __( 'You are about to unspam the site %s.' ),
 73		/* translators: %s: Site URL. */
 74		'spamblog'       => __( 'You are about to mark the site %s as spam.' ),
 75		/* translators: %s: Site URL. */
 76		'deleteblog'     => __( 'You are about to delete the site %s.' ),
 77		/* translators: %s: Site URL. */
 78		'unmatureblog'   => __( 'You are about to mark the site %s as mature.' ),
 79		/* translators: %s: Site URL. */
 80		'matureblog'     => __( 'You are about to mark the site %s as not mature.' ),
 81	);
 82
 83	if ( 'confirm' === $_GET['action'] ) {
 84		// The action2 parameter contains the action being taken on the site.
 85		$site_action = $_GET['action2'];
 86
 87		if ( ! array_key_exists( $site_action, $manage_actions ) ) {
 88			wp_die( __( 'The requested action is not valid.' ) );
 89		}
 90
 91		// The mature/unmature UI exists only as external code. Check the "confirm" nonce for backward compatibility.
 92		if ( 'matureblog' === $site_action || 'unmatureblog' === $site_action ) {
 93			check_admin_referer( 'confirm' );
 94		} else {
 95			check_admin_referer( $site_action . '_' . $id );
 96		}
 97
 98		if ( ! headers_sent() ) {
 99			nocache_headers();
100			header( 'Content-Type: text/html; charset=utf-8' );
101		}
102
103		if ( is_main_site( $id ) ) {
104			wp_die( __( 'Sorry, you are not allowed to change the current site.' ) );
105		}
106
107		$site_details = get_site( $id );
108		$site_address = untrailingslashit( $site_details->domain . $site_details->path );
109		$submit       = __( 'Confirm' );
110
111		require_once ABSPATH . 'wp-admin/admin-header.php';
112		?>
113			<div class="wrap">
114				<h1><?php _e( 'Confirm your action' ); ?></h1>
115				<form action="sites.php?action=<?php echo esc_attr( $site_action ); ?>" method="post">
116					<input type="hidden" name="action" value="<?php echo esc_attr( $site_action ); ?>" />
117					<input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" />
118					<input type="hidden" name="_wp_http_referer" value="<?php echo esc_attr( wp_get_referer() ); ?>" />
119					<?php wp_nonce_field( $site_action . '_' . $id, '_wpnonce', false ); ?>
120					<?php
121					if ( 'deleteblog' === $site_action ) {
122						$submit = __( 'Delete this site permanently' );
123						?>
124						<div class="notice notice-warning inline">
125							<p><?php _e( 'Deleting a site is a permanent action that cannot be undone. This will delete the entire site and its uploads directory.' ); ?>
126						</div>
127						<?php
128					} elseif ( 'archiveblog' === $site_action ) {
129						?>
130						<div class="notice notice-warning inline">
131							<p><?php _e( 'Archiving a site makes the site unavailable to its users and visitors. This is a reversible action.' ); ?>
132						</div>
133						<?php
134					} elseif ( 'deactivateblog' === $site_action ) {
135						?>
136						<div class="notice notice-warning inline">
137							<p><?php _e( 'Flagging a site for deletion makes the site unavailable to its users and visitors. This is a reversible action. A super admin can permanently delete the site at a later date.' ); ?>
138						</div>
139						<?php
140					}
141					?>
142					<p><?php printf( $manage_actions[ $site_action ], "<strong>{$site_address}</strong>" ); ?></p>
143					<?php submit_button( $submit, 'primary' ); ?>
144				</form>
145			</div>
146		<?php
147		require_once ABSPATH . 'wp-admin/admin-footer.php';
148		exit;
149	} elseif ( array_key_exists( $_GET['action'], $manage_actions ) ) {
150		$action = $_GET['action'];
151		check_admin_referer( $action . '_' . $id );
152	} elseif ( 'allblogs' === $_GET['action'] ) {
153		check_admin_referer( 'bulk-sites' );
154	}
155
156	$updated_action = '';
157
158	switch ( $_GET['action'] ) {
159
160		case 'deleteblog':
161			if ( ! current_user_can( 'delete_sites' ) ) {
162				wp_die( __( 'Sorry, you are not allowed to access this page.' ), '', array( 'response' => 403 ) );
163			}
164
165			$updated_action = 'not_deleted';
166			if ( 0 !== $id && ! is_main_site( $id ) && current_user_can( 'delete_site', $id ) ) {
167				wpmu_delete_blog( $id, true );
168				$updated_action = 'delete';
169			}
170			break;
171
172		case 'delete_sites':
173			check_admin_referer( 'ms-delete-sites' );
174
175			foreach ( (array) $_POST['site_ids'] as $site_id ) {
176				$site_id = (int) $site_id;
177
178				if ( is_main_site( $site_id ) ) {
179					continue;
180				}
181
182				if ( ! current_user_can( 'delete_site', $site_id ) ) {
183					$site         = get_site( $site_id );
184					$site_address = untrailingslashit( $site->domain . $site->path );
185
186					wp_die(
187						sprintf(
188							/* translators: %s: Site URL. */
189							__( 'Sorry, you are not allowed to delete the site %s.' ),
190							$site_address
191						),
192						403
193					);
194				}
195
196				$updated_action = 'all_delete';
197				wpmu_delete_blog( $site_id, true );
198			}
199			break;
200
201		case 'allblogs':
202			if ( isset( $_POST['action'] ) && isset( $_POST['allblogs'] ) ) {
203				$doaction = $_POST['action'];
204
205				foreach ( (array) $_POST['allblogs'] as $site_id ) {
206					$site_id = (int) $site_id;
207
208					if ( 0 !== $site_id && ! is_main_site( $site_id ) ) {
209						switch ( $doaction ) {
210							case 'delete':
211								require_once ABSPATH . 'wp-admin/admin-header.php';
212								?>
213								<div class="wrap">
214									<h1><?php _e( 'Confirm your action' ); ?></h1>
215									<form action="sites.php?action=delete_sites" method="post">
216										<input type="hidden" name="action" value="delete_sites" />
217										<input type="hidden" name="_wp_http_referer" value="<?php echo esc_attr( wp_get_referer() ); ?>" />
218										<?php wp_nonce_field( 'ms-delete-sites', '_wpnonce', false ); ?>
219										<div class="notice notice-warning inline">
220											<p><?php _e( 'Deleting a site is a permanent action that cannot be undone. This will delete the entire site and its uploads directory.' ); ?>
221										</div>
222										<p><?php _e( 'You are about to delete the following sites:' ); ?></p>
223										<ul class="ul-disc">
224											<?php
225											foreach ( $_POST['allblogs'] as $site_id ) :
226												$site_id = (int) $site_id;
227
228												$site         = get_site( $site_id );
229												$site_address = untrailingslashit( $site->domain . $site->path );
230												?>
231												<li>
232													<?php echo $site_address; ?>
233													<input type="hidden" name="site_ids[]" value="<?php echo esc_attr( $site_id ); ?>" />
234												</li>
235											<?php endforeach; ?>
236										</ul>
237										<?php submit_button( __( 'Delete these sites permanently' ), 'primary' ); ?>
238									</form>
239								</div>
240								<?php
241								require_once ABSPATH . 'wp-admin/admin-footer.php';
242								exit;
243							break;
244
245							case 'spam':
246							case 'notspam':
247								$updated_action = ( 'spam' === $doaction ) ? 'all_spam' : 'all_notspam';
248								update_blog_status( $site_id, 'spam', ( 'spam' === $doaction ) ? '1' : '0' );
249								break;
250						}
251					} else {
252						wp_die( __( 'Sorry, you are not allowed to change the current site.' ) );
253					}
254				}
255
256				if ( ! in_array( $doaction, array( 'delete', 'spam', 'notspam' ), true ) ) {
257					$redirect_to = wp_get_referer();
258					$blogs       = (array) $_POST['allblogs'];
259
260					/** This action is documented in wp-admin/network/site-themes.php */
261					$redirect_to = apply_filters( 'handle_network_bulk_actions-' . get_current_screen()->id, $redirect_to, $doaction, $blogs, $id ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
262
263					wp_safe_redirect( $redirect_to );
264					exit;
265				}
266			} else {
267				// Process query defined by WP_MS_Site_List_Table::extra_table_nav().
268				$location = remove_query_arg(
269					array( '_wp_http_referer', '_wpnonce' ),
270					add_query_arg( $_POST, network_admin_url( 'sites.php' ) )
271				);
272
273				wp_redirect( $location );
274				exit;
275			}
276
277			break;
278
279		case 'archiveblog':
280		case 'unarchiveblog':
281			update_blog_status( $id, 'archived', ( 'archiveblog' === $_GET['action'] ) ? '1' : '0' );
282			break;
283
284		case 'activateblog':
285			update_blog_status( $id, 'deleted', '0' );
286
287			/**
288			 * Fires after a network site has its deletion flag removed.
289			 *
290			 * @since MU (3.0.0)
291			 *
292			 * @param int $id The ID of the reactivated site.
293			 */
294			do_action( 'activate_blog', $id );
295			break;
296
297		case 'deactivateblog':
298			/**
299			 * Fires before a network site is flagged for deletion.
300			 *
301			 * @since MU (3.0.0)
302			 *
303			 * @param int $id The ID of the site being flagged for deletion.
304			 */
305			do_action( 'deactivate_blog', $id );
306
307			update_blog_status( $id, 'deleted', '1' );
308			break;
309
310		case 'unspamblog':
311		case 'spamblog':
312			update_blog_status( $id, 'spam', ( 'spamblog' === $_GET['action'] ) ? '1' : '0' );
313			break;
314
315		case 'unmatureblog':
316		case 'matureblog':
317			update_blog_status( $id, 'mature', ( 'matureblog' === $_GET['action'] ) ? '1' : '0' );
318			break;
319	}
320
321	if ( empty( $updated_action ) && array_key_exists( $_GET['action'], $manage_actions ) ) {
322		$updated_action = $_GET['action'];
323	}
324
325	if ( ! empty( $updated_action ) ) {
326		wp_safe_redirect( add_query_arg( array( 'updated' => $updated_action ), wp_get_referer() ) );
327		exit;
328	}
329}
330
331$msg = '';
332if ( isset( $_GET['updated'] ) ) {
333	$action = $_GET['updated'];
334
335	switch ( $action ) {
336		case 'all_notspam':
337			$msg = __( 'Sites removed from spam.' );
338			break;
339		case 'all_spam':
340			$msg = __( 'Sites marked as spam.' );
341			break;
342		case 'all_delete':
343			$msg = __( 'Sites permanently deleted.' );
344			break;
345		case 'delete':
346			$msg = __( 'Site permanently deleted.' );
347			break;
348		case 'not_deleted':
349			$msg = __( 'Sorry, you are not allowed to delete that site.' );
350			break;
351		case 'archiveblog':
352			$msg = __( 'Site archived.' );
353			break;
354		case 'unarchiveblog':
355			$msg = __( 'Site unarchived.' );
356			break;
357		case 'activateblog':
358			$msg = __( 'Site deletion flag removed.' );
359			break;
360		case 'deactivateblog':
361			$msg = __( 'Site flagged for deletion.' );
362			break;
363		case 'unspamblog':
364			$msg = __( 'Site removed from spam.' );
365			break;
366		case 'spamblog':
367			$msg = __( 'Site marked as spam.' );
368			break;
369		default:
370			/**
371			 * Filters a specific, non-default, site-updated message in the Network admin.
372			 *
373			 * The dynamic portion of the hook name, `$action`, refers to the non-default
374			 * site update action.
375			 *
376			 * @since 3.1.0
377			 *
378			 * @param string $msg The update message. Default 'Settings saved'.
379			 */
380			$msg = apply_filters( "network_sites_updated_message_{$action}", __( 'Settings saved.' ) );
381			break;
382	}
383
384	if ( ! empty( $msg ) ) {
385		$msg = wp_get_admin_notice(
386			$msg,
387			array(
388				'type'        => 'success',
389				'dismissible' => true,
390				'id'          => 'message',
391			)
392		);
393	}
394}
395
396$wp_list_table->prepare_items();
397
398require_once ABSPATH . 'wp-admin/admin-header.php';
399?>
400
401<div class="wrap">
402<h1 class="wp-heading-inline"><?php _e( 'Sites' ); ?></h1>
403
404<?php if ( current_user_can( 'create_sites' ) ) : ?>
405	<a href="<?php echo esc_url( network_admin_url( 'site-new.php' ) ); ?>" class="page-title-action"><?php echo esc_html__( 'Add Site' ); ?></a>
406<?php endif; ?>
407
408<?php
409if ( isset( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
410	echo '<span class="subtitle">';
411	printf(
412		/* translators: %s: Search query. */
413		__( 'Search results for: %s' ),
414		'<strong>' . esc_html( $s ) . '</strong>'
415	);
416	echo '</span>';
417}
418?>
419
420<hr class="wp-header-end">
421
422<?php $wp_list_table->views(); ?>
423
424<?php echo $msg; ?>
425
426<form method="get" id="ms-search" class="wp-clearfix">
427<?php $wp_list_table->search_box( __( 'Search Sites' ), 'site' ); ?>
428<input type="hidden" name="action" value="blogs" />
429</form>
430
431<form id="form-site-list" action="sites.php?action=allblogs" method="post">
432	<?php $wp_list_table->display(); ?>
433</form>
434</div>
435<?php
436
437require_once ABSPATH . 'wp-admin/admin-footer.php'; ?>
438