From 8c29f283d7b4cde13bfeff0010c4a4cfb416d4b7 Mon Sep 17 00:00:00 2001
From: Peter Wilson <wilson@peterwilson.cc>
Date: Fri, 8 Apr 2022 06:26:02 +0000
Subject: [PATCH] Users: Prevent author changes in bulk editor on large sites.

On large sites (with over 1000 users), include a hidden `post_author` field in the bulk editing interface to preven unexpected authorship changes.

Follow up to [53011], [53049].

Props georgestephanis, tobifjellner, peterwilsoncc, spacedmonkey, jb510.
Fixes #38741.


Built from https://develop.svn.wordpress.org/trunk@53105


git-svn-id: http://core.svn.wordpress.org/trunk@52694 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 .../includes/class-wp-posts-list-table.php    | 68 ++++++++++---------
 wp-includes/version.php                       |  2 +-
 2 files changed, 38 insertions(+), 32 deletions(-)

diff --git a/wp-admin/includes/class-wp-posts-list-table.php b/wp-admin/includes/class-wp-posts-list-table.php
index b6858a1e10..b36baf8448 100644
--- a/wp-admin/includes/class-wp-posts-list-table.php
+++ b/wp-admin/includes/class-wp-posts-list-table.php
@@ -1653,43 +1653,49 @@ class WP_Posts_List_Table extends WP_List_Table {
 				<?php endif; // $bulk ?>
 
 				<?php
-				if ( post_type_supports( $screen->post_type, 'author' ) && ! wp_is_large_user_count() ) {
+				if ( post_type_supports( $screen->post_type, 'author' ) ) {
 					$authors_dropdown = '';
 
 					if ( current_user_can( $post_type_object->cap->edit_others_posts ) ) {
-						$users_opt = array(
-							'hide_if_only_one_author' => false,
-							'capability'              => array( $post_type_object->cap->edit_posts ),
-							'name'                    => 'post_author',
-							'class'                   => 'authors',
-							'multi'                   => 1,
-							'echo'                    => 0,
-							'show'                    => 'display_name_with_login',
-						);
+						$dropdown_name  = 'post_author';
+						$dropdown_class = 'authors';
+						if ( wp_is_large_user_count() ) {
+							$authors_dropdown = sprintf( '<select name="%s" class="%s hidden"></select>', esc_attr( $dropdown_name ), esc_attr( $dropdown_class ) );
+						} else {
+							$users_opt = array(
+								'hide_if_only_one_author' => false,
+								'capability'              => array( $post_type_object->cap->edit_posts ),
+								'name'                    => $dropdown_name,
+								'class'                   => $dropdown_class,
+								'multi'                   => 1,
+								'echo'                    => 0,
+								'show'                    => 'display_name_with_login',
+							);
 
-						if ( $bulk ) {
-							$users_opt['show_option_none'] = __( '&mdash; No Change &mdash;' );
-						}
+							if ( $bulk ) {
+								$users_opt['show_option_none'] = __( '&mdash; No Change &mdash;' );
+							}
 
-						/**
-						 * Filters the arguments used to generate the Quick Edit authors drop-down.
-						 *
-						 * @since 5.6.0
-						 *
-						 * @see wp_dropdown_users()
-						 *
-						 * @param array $users_opt An array of arguments passed to wp_dropdown_users().
-						 * @param bool  $bulk      A flag to denote if it's a bulk action.
-						 */
-						$users_opt = apply_filters( 'quick_edit_dropdown_authors_args', $users_opt, $bulk );
+							/**
+							 * Filters the arguments used to generate the Quick Edit authors drop-down.
+							 *
+							 * @since 5.6.0
+							 *
+							 * @see wp_dropdown_users()
+							 *
+							 * @param array $users_opt An array of arguments passed to wp_dropdown_users().
+							 * @param bool $bulk A flag to denote if it's a bulk action.
+							 */
+							$users_opt = apply_filters( 'quick_edit_dropdown_authors_args', $users_opt, $bulk );
 
-						$authors = wp_dropdown_users( $users_opt );
+							$authors = wp_dropdown_users( $users_opt );
 
-						if ( $authors ) {
-							$authors_dropdown  = '<label class="inline-edit-author">';
-							$authors_dropdown .= '<span class="title">' . __( 'Author' ) . '</span>';
-							$authors_dropdown .= $authors;
-							$authors_dropdown .= '</label>';
+							if ( $authors ) {
+								$authors_dropdown  = '<label class="inline-edit-author">';
+								$authors_dropdown .= '<span class="title">' . __( 'Author' ) . '</span>';
+								$authors_dropdown .= $authors;
+								$authors_dropdown .= '</label>';
+							}
 						}
 					} // current_user_can( 'edit_others_posts' )
 
@@ -1748,7 +1754,7 @@ class WP_Posts_List_Table extends WP_List_Table {
 				<div class="inline-edit-col">
 
 				<?php
-				if ( post_type_supports( $screen->post_type, 'author' ) && ! wp_is_large_user_count() && $bulk ) {
+				if ( post_type_supports( $screen->post_type, 'author' ) && $bulk ) {
 					echo $authors_dropdown;
 				}
 				?>
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 60426da19d..0ba014b718 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.0-alpha-53104';
+$wp_version = '6.0-alpha-53105';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.