<h2>File Contents: /home/planet5/www/4xpips.net/wp-content/off-plugins/role-scoper/copy_of_role-scoper_main.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/www/4xpips.net/wp-content/off-plugins/role-scoper/copy_of_role-scoper_main.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php
if( basename(__FILE__) == basename($_SERVER[&#039;SCRIPT_FILENAME&#039;]) )
	die( &#039;This page cannot be called directly.&#039; );
	
/**
 * Scoper PHP class for the WordPress plugin Role Scoper
 * role-scoper_main.php
 * 
 * @author 		Kevin Behrens
 * @copyright 	Copyright 2012-2016
 * 
 */
class Scoper
{
	var $definitions;
	var $access_types;
	var $data_sources;
	var $taxonomies;
	var $cap_defs;
	var $role_defs;
	
	var $cap_interceptor;		// legacy API
	
	// === Temporary status variables ===
	var $direct_file_access;
	var $listed_ids = array();  // $listed_ids[src_name][object_id] = true : general purpose memory cache for non-post data sources; primary use is with has_cap filter to avoid a separate db query for each listed item 

	var $default_restrictions = array();

	// minimal config retrieval to support pre-init usage by WP_Scoped_User before text domain is loaded
	function __construct() {
		$this-&gt;definitions = array( &#039;data_sources&#039; =&gt; &#039;Data_Sources&#039;, &#039;taxonomies&#039; =&gt; &#039;Taxonomies&#039;, &#039;cap_defs&#039; =&gt; &#039;Capabilities&#039;, &#039;role_defs&#039; =&gt; &#039;Roles&#039; );	
		require_once( dirname(__FILE__).&#039;/definitions_cr.php&#039; );
		
		if ( defined( &#039;RVY_VERSION&#039; ) )
			$this-&gt;cap_interceptor = (object) array();	// legacy support for Revisionary &lt; 1.1 which set flags on this object property
	}
	
	function load_config() {
		require_once( dirname(__FILE__).&#039;/lib/agapetry_config_items.php&#039;);
		$this-&gt;access_types = new AGP_Config_Items();
		$this-&gt;access_types-&gt;init( cr_access_types() );  // &#039;front&#039; and &#039;admin&#039; are the hardcoded access types
		
		// establish access type for this http request
		$access_name = ( is_admin() || defined(&#039;XMLRPC_REQUEST&#039;) ) ? &#039;admin&#039; : &#039;front&#039;;
		$access_name = apply_filters( &#039;scoper_access_name&#039;, $access_name );		// others plugins can apply additional criteria for treating a particular URL with wp-admin or front-end filtering
		if ( ! defined(&#039;CURRENT_ACCESS_NAME_RS&#039;) )
			define(&#039;CURRENT_ACCESS_NAME_RS&#039;, $access_name);

		// disable RS filtering of access type(s) if specified in realm options 
		if ( ! is_admin() || ! defined(&#039;SCOPER_REALM_ADMIN_RS&#039;) ) {		// don&#039;t remove items if the option is being editied
			if ( $disabled_access_types = scoper_get_option(&#039;disabled_access_types&#039;) )
				$this-&gt;access_types-&gt;remove_members_by_key($disabled_access_types, true);
				
			// If the detected access type (admin, front or custom) was &quot;disabled&quot;, it is still detected, but we note that query filters should not be applied
			if ( ! $this-&gt;access_types-&gt;is_member($access_name) )
				define(&#039;DISABLE_QUERYFILTERS_RS&#039;, true);
		}
		
		// populate data_sources, taxonomies, cap_defs, role_defs arrays
		foreach( array_keys($this-&gt;definitions) as $topic )
			$this-&gt;load_definition( $topic );	
			
		foreach( array_keys($this-&gt;definitions) as $topic )
			$this-&gt;$topic-&gt;lock();

		// clean up after 3rd party plugins (such as Role Scoping for NGG) which don&#039;t set object type and src_name properties for roles
		if ( has_filter( &#039;define_roles_rs&#039; ) ) {
			require_once( dirname(__FILE__).&#039;/extension-helper_rs.php&#039; );
			scoper_adjust_legacy_extension_cfg( $this-&gt;role_defs, $this-&gt;cap_defs );
		}
		
		add_action( &#039;set_current_user&#039;, array( &amp;$this, &#039;credit_blogroles&#039; ) );
		
		$this-&gt;credit_blogroles();

		do_action(&#039;config_loaded_rs&#039;);
	}
	
	function credit_blogroles() {
		// credit non-logged and &quot;no role&quot; users for any anonymous roles
		global $current_rs_user;
		
		if ( $current_rs_user ) {
			if ( empty($current_rs_user-&gt;ID) ) {
				foreach ( $this-&gt;role_defs-&gt;filter_keys( -1, array( &#039;anon_user_blogrole&#039; =&gt; true ) ) as $role_handle) {
					$current_rs_user-&gt;assigned_blog_roles[ANY_CONTENT_DATE_RS][$role_handle] = true;
					$current_rs_user-&gt;blog_roles[ANY_CONTENT_DATE_RS][$role_handle] = true;
				}
			}
	
			if ( isset($current_rs_user-&gt;assigned_blog_roles) )
				$this-&gt;refresh_blogroles();
		}
	}
	
	function refresh_blogroles() {
		global $current_rs_user;
		
		if ( empty($current_rs_user) )
			return;
		
		if ( is_multisite() &amp;&amp; ! is_user_member_of_blog() &amp;&amp; empty($GLOBALS[&#039;current_user&#039;]-&gt;allcaps) ) {
			$GLOBALS[&#039;current_user&#039;]-&gt;allcaps[&#039;read&#039;] = true;
			$current_rs_user-&gt;allcaps[&#039;read&#039;] = true;
		}
		
		$current_rs_user-&gt;merge_scoped_blogcaps();
		$GLOBALS[&#039;current_user&#039;]-&gt;allcaps = array_merge( $GLOBALS[&#039;current_user&#039;]-&gt;allcaps, $current_rs_user-&gt;allcaps );
		
		if ( empty($GLOBALS[&#039;current_user&#039;]-&gt;data) )
			$GLOBALS[&#039;current_user&#039;]-&gt;data = (object) array();

		foreach( array( &#039;groups&#039;, &#039;blog_roles&#039;, &#039;assigned_blog_roles&#039; ) as $var ) {
			if ( isset($current_rs_user-&gt;$var) )
				$GLOBALS[&#039;current_user&#039;]-&gt;$var = $current_rs_user-&gt;$var;
		}

		if ( $current_rs_user-&gt;ID || defined( &#039;SCOPER_ANON_METAGROUP&#039; ) ) {
			foreach ( array_keys($current_rs_user-&gt;assigned_blog_roles) as $date_key )
				$current_rs_user-&gt;blog_roles[$date_key] = $this-&gt;role_defs-&gt;add_contained_roles( $current_rs_user-&gt;assigned_blog_roles[$date_key] );
		}
	}
	
	function load_definition( $topic ) {
		$class_name = &quot;CR_&quot; . $this-&gt;definitions[$topic];
		require_once( strtolower($this-&gt;definitions[$topic]) . &#039;_rs.php&#039; );

		$filter_name = &quot;define_&quot; . strtolower($this-&gt;definitions[$topic]) . &quot;_rs&quot;;
		$this-&gt;$topic = apply_filters( $filter_name, new $class_name( call_user_func(&quot;cr_{$topic}&quot;) ) );

		if ( &#039;role_defs&#039; == $topic ) {
			$this-&gt;role_defs-&gt;role_caps = apply_filters(&#039;define_role_caps_rs&#039;, cr_role_caps() );
			
			if ( $user_role_caps = scoper_get_option( &#039;user_role_caps&#039; ) )
				$this-&gt;role_defs-&gt;add_role_caps( $user_role_caps );

			$this-&gt;log_cap_usage( $this-&gt;role_defs, $this-&gt;cap_defs );  // add any otype associations from new user_role_caps, but don&#039;t remove an otype association due to disabled_role_caps

			if ( $disabled_role_caps = scoper_get_option( &#039;disabled_role_caps&#039; ) )
				$this-&gt;role_defs-&gt;remove_role_caps( $disabled_role_caps );

			$this-&gt;role_defs-&gt;remove_invalid(); // currently don&#039;t allow additional custom-defined post, page or link roles

			$this-&gt;customize_role_objscope();
			
			// To support merging in of WP role assignments, always note actual WP-defined roles 
			// regardless of which role type we are scoping with.
			$this-&gt;log_wp_roles( $this-&gt;role_defs );
		}
	}
	
	function log_cap_usage( &amp;$role_defs, &amp;$cap_defs ) {
		foreach( $role_defs-&gt;members as $role_handle =&gt; $role_def ) {
			
			foreach( array_keys( $role_defs-&gt;role_caps[$role_handle] ) as $cap_name ) {
				if ( empty( $cap_defs-&gt;members[$cap_name]-&gt;object_types ) || ! in_array( $role_def-&gt;object_type, $cap_defs-&gt;members[$cap_name]-&gt;object_types ) ) {
					if ( &#039;post&#039; == $role_def-&gt;src_name )
						$cap_defs-&gt;members[$cap_name]-&gt;object_types[] = $role_def-&gt;object_type;
						
					elseif ( in_array( $role_def-&gt;src_name, array( &#039;link&#039;, &#039;group&#039; ) ) )	// TODO: other data sources?
						$cap_defs-&gt;members[$cap_name]-&gt;object_types[] = $role_def-&gt;src_name;
				}
			}
		}
	}
	
	function customize_role_objscope() {
		foreach ( $this-&gt;role_defs-&gt;get_all_keys() as $role_handle ) {
			if ( ! empty($this-&gt;role_defs-&gt;members[$role_handle]-&gt;objscope_equivalents) ) {
				foreach( $this-&gt;role_defs-&gt;members[$role_handle]-&gt;objscope_equivalents as $equiv_key =&gt; $equiv_role_handle ) {
					
					if ( scoper_get_option( &quot;{$equiv_role_handle}_role_objscope&quot; ) ) {	// If &quot;Additional Object Role&quot; option is set for this role, treat it as a regular direct-assigned Object Role

						if ( isset($this-&gt;role_defs-&gt;members[$equiv_role_handle]-&gt;valid_scopes) )
							$this-&gt;role_defs-&gt;members[$equiv_role_handle]-&gt;valid_scopes = array(&#039;blog&#039; =&gt; 1, &#039;term&#039; =&gt; 1, &#039;object&#039; =&gt; 1);

						unset( $this-&gt;role_defs-&gt;members[$role_handle]-&gt;objscope_equivalents[$equiv_key] );
				
						if ( ! defined( &#039;DISABLE_OBJSCOPE_EQUIV_&#039; . $role_handle ) )
							define( &#039;DISABLE_OBJSCOPE_EQUIV_&#039; . $role_handle, true );	// prevent Role Caption / Abbrev from being substituted from equivalent role
					}
				}
			}
		}	
	}
	
	function log_wp_roles( &amp;$role_defs ) {
		global $wp_roles;
		if ( ! isset($wp_roles) )
			$wp_roles = new WP_Roles();
			
		// populate WP roles least-role-first to match RS roles
		$keys = array_keys($wp_roles-&gt;role_objects);
		$keys = array_reverse($keys);

		$cr_cap_names = $this-&gt;cap_defs-&gt;get_all_keys();
		
		$last_lock = $role_defs-&gt;locked;
		$role_defs-&gt;locked = false;

		foreach ( $keys as $role_name ) {
			if ( ! empty( $wp_roles-&gt;role_objects[$role_name]-&gt;capabilities ) ) {
				// remove any WP caps which are in array, but have value = false
				if ( $caps = array_intersect( $wp_roles-&gt;role_objects[$role_name]-&gt;capabilities, array(true) ) )
					$caps = array_intersect_key( $caps, array_flip($cr_cap_names) );  // we only care about WP caps that are RS-defined
			} else
				$caps = array();

			$role_defs-&gt;add_item( $role_name, &#039;wordpress&#039;, &#039;&#039;, &#039;&#039;, &#039;wp&#039; );

			// temp hardcode for site-wide Nav Menu cap
			if ( ! empty( $caps[&#039;edit_theme_options&#039;] ) )
				$caps[&#039;manage_nav_menus&#039;] = true;

			$role_defs-&gt;role_caps[&#039;wp_&#039; . $role_name] = $caps;
		}
		
		$role_defs-&gt;locked = $last_lock;
	}
	
	
	function init() {
		scoper_version_check();
		
		if ( ! isset($this-&gt;data_sources) )
			$this-&gt;load_config();
		
		$is_administrator = is_content_administrator_rs();
		
		if ( $doing_cron = defined(&#039;DOING_CRON&#039;) )
			if ( ! defined(&#039;DISABLE_QUERYFILTERS_RS&#039;) )
				define(&#039;DISABLE_QUERYFILTERS_RS&#039;, true);
		
		if ( ! $this-&gt;direct_file_access = strpos($_SERVER[&#039;QUERY_STRING&#039;], &#039;rs_rewrite&#039;) )
			$this-&gt;add_main_filters();
			
		// ===== Special early exit if this is a plugin install script
		if ( is_admin() ) {
			if ( in_array( $GLOBALS[&#039;pagenow&#039;], array( &#039;plugin-install.php&#039;, &#039;plugin-editor.php&#039; ) ) ) {
				do_action( &#039;scoper_init&#039; );
				return; // no further filtering on WP plugin maintenance scripts
			}
		}
		// =====

		require_once( dirname(__FILE__).&#039;/attachment-interceptor_rs.php&#039;);
		$GLOBALS[&#039;attachment_interceptor&#039;] = new AttachmentInterceptor_RS(); // .htaccess file is always there, so we always need to handle its rewrites
				
		// ===== Content Filters to limit/enable the current user
		$disable_queryfilters = defined(&#039;DISABLE_QUERYFILTERS_RS&#039;);
		
		if ( $disable_queryfilters ) {
			// Some wp-admin pages need to list pages or categories based on front-end access.  Classic example is Subscribe2 categories checklist, included in Subscriber profile
			// In that case, filtering will be applied even if wp-admin filtering is disabled.  API hook enables other plugins to defined their own &quot;always filter&quot; URIs.
			$always_filter_uris = apply_filters( &#039;scoper_always_filter_uris&#039;, array( &#039;p-admin/profile.php&#039; ) );

			if ( in_array( $GLOBALS[&#039;pagenow&#039;], $always_filter_uris ) || in_array( $GLOBALS[&#039;plugin_page_cr&#039;], $always_filter_uris ) ) {
				$disable_queryfilters = false;
			}
		}
		
		// register a map_meta_cap filter to handle the type-specific meta caps we are forcing
		require_once( dirname(__FILE__).&#039;/meta_caps_rs.php&#039; );	

		if ( ! $disable_queryfilters ) {
			 if ( ! $is_administrator ) {
				if ( $this-&gt;direct_file_access ) {
					require_once( dirname(__FILE__).&#039;/cap-interceptor-basic_rs.php&#039;);  // only need to support basic read_post / read_page check for direct file access
					$GLOBALS[&#039;cap_interceptor_basic&#039;] = new CapInterceptorBasic_RS();
				} else {
					require_once( dirname(__FILE__).&#039;/cap-interceptor_rs.php&#039;);
					$GLOBALS[&#039;cap_interceptor&#039;] = new CapInterceptor_RS();
				}
			}

			// (also use content filters on front end to FILTER IN private content which WP inappropriately hides from administrators)
			if ( ( ! $is_administrator ) || $this-&gt;is_front() ) {
				require_once( dirname(__FILE__).&#039;/query-interceptor_rs.php&#039;);
				$GLOBALS[&#039;query_interceptor&#039;] = new QueryInterceptor_RS();
			}

			if ( ( ! $this-&gt;direct_file_access ) &amp;&amp; ( ! $is_administrator || ! defined(&#039;XMLRPC_REQUEST&#039;) ) ) { // don&#039;t tempt trouble by adding hardway filters on XMLRPC for logged administrator
				$this-&gt;add_hardway_filters();
				
				if ( $this-&gt;is_front() || ! $is_administrator ) {
					require_once( dirname(__FILE__).&#039;/terms-query-lib_rs.php&#039;);
				
					if ( awp_ver( &#039;3.1&#039; ) &amp;&amp; ! defined( &#039;SCOPER_LEGACY_TERMS_FILTER&#039; ) ) {
						require_once( dirname(__FILE__).&#039;/terms-interceptor_rs.php&#039;);
						$GLOBALS[&#039;terms_interceptor&#039;] = new TermsInterceptor_RS();
					} else
						require_once( dirname(__FILE__).&#039;/hardway/hardway-taxonomy-legacy_rs.php&#039;);
				}
			}

		} // endif query filtering not disabled for this access type

		if ( $is_administrator ) {
			if ( $this-&gt;is_front() )
				require_once( &#039;comments-int-administrator_rs.php&#039; );
		} else
			require_once( &#039;comments-interceptor_rs.php&#039; );
		
		if ( is_admin() )
			$this-&gt;add_admin_ui_filters( $is_administrator );
		
		do_action( &#039;scoper_init&#039; );
		
		// ===== end Content Filters
		
	} // end function init
	
	
	// filters which are only needed for the wp-admin UI
	function add_admin_ui_filters( $is_administrator ) {
		global $pagenow;
		
		// ===== Admin filters (menu and other basics) which are (almost) always loaded 
		require_once( dirname(__FILE__).&#039;/admin/admin_rs.php&#039;);
		$GLOBALS[&#039;scoper_admin&#039;] = new ScoperAdmin();
		
		if ( &#039;async-upload.php&#039; != $pagenow ) {
			if ( ! defined(&#039;DISABLE_QUERYFILTERS_RS&#039;) || $is_administrator ) {
				require_once( dirname(__FILE__).&#039;/admin/filters-admin-ui_rs.php&#039; );
				$GLOBALS[&#039;scoper_admin_filters_ui&#039;] = new ScoperAdminFiltersUI();
			}
		}
		// =====

		// ===== Script-specific Admin filters 
		if ( &#039;users.php&#039; == $pagenow ) {
			require_once( dirname(__FILE__).&#039;/admin/filters-admin-users_rs.php&#039; );
			
		} elseif ( &#039;edit.php&#039; == $pagenow ) {
			if ( ! defined(&#039;DISABLE_QUERYFILTERS_RS&#039;) || $is_administrator )
				require_once( dirname(__FILE__).&#039;/admin/filters-admin-ui-listing_rs.php&#039; );

		} elseif ( in_array( $pagenow, array( &#039;edit-tags.php&#039;, &#039;edit-link-categories.php&#039; ) ) ) {
			if ( ! defined(&#039;DISABLE_QUERYFILTERS_RS&#039;) )
				require_once( dirname(__FILE__).&#039;/admin/filters-admin-terms_rs.php&#039; );
		}
		// =====
		
		if ( scoper_get_option( &#039;group_ajax&#039; ) &amp;&amp; ( isset( $_GET[&#039;rs_user_search&#039;] ) || isset( $_GET[&#039;rs_group_search&#039;] ) ) ) {
			require_once( dirname(__FILE__).&#039;/admin/user_query_rs.php&#039; );
			exit;	
		} 
	}
	
	function add_hardway_filters() {
		// port or low-level query filters to work around limitations in WP core API
		require_once( dirname(__FILE__).&#039;/hardway/hardway_rs.php&#039;); // need get_pages() filtering to include private pages for some 3rd party plugin config UI (Simple Section Nav)
		
		// buffering of taxonomy children is disabled with non-admin user logged in
		// But that non-admin user may add cats.  Don&#039;t allow unfiltered admin to rely on an old copy of children
		global $wp_taxonomies;
		if ( ! empty($wp_taxonomies) ) {
			foreach ( array_keys($wp_taxonomies) as $taxonomy )
				add_filter ( &quot;option_{$taxonomy}_children&quot;, create_function( &#039;$option_value&#039;, &quot;return rs_get_terms_children(&#039;$taxonomy&#039;, &quot; . &#039;$option_value );&#039;) );
				//add_filter(&quot;option_{$taxonomy}_children&quot;, create_function( &#039;&#039;, &quot;return rs_get_terms_children(&#039;$taxonomy&#039;);&quot;) );
		}

		if ( is_admin() || defined(&#039;XMLRPC_REQUEST&#039;) ) {
            global $pagenow;
			
			if ( ! in_array( $pagenow, array( &#039;plugin-editor.php&#039;, &#039;plugins.php&#039; ) ) ) {
	            global $plugin_page_cr;

				// low-level filtering for miscellaneous admin operations which are not well supported by the WP API
				$hardway_uris = array(
				&#039;index.php&#039;,		&#039;revision.php&#039;,			&#039;admin.php?page=rvy-revisions&#039;,
				&#039;post.php&#039;, 		&#039;post-new.php&#039;, 		&#039;edit.php&#039;, 
				&#039;upload.php&#039;, 		&#039;edit-comments.php&#039;, 	&#039;edit-tags.php&#039;,
				&#039;profile.php&#039;,		&#039;admin-ajax.php&#039;,
				&#039;link-manager.php&#039;, &#039;link-add.php&#039;,			&#039;link.php&#039;,		 
				&#039;edit-link-category.php&#039;, 	&#039;edit-link-categories.php&#039;,
				&#039;media-upload.php&#039;,	&#039;nav-menus.php&#039;  
				);

				$hardway_uris = apply_filters( &#039;scoper_admin_hardway_uris&#039;, $hardway_uris );
																															// support for rs-config-ngg &lt;= 1.0
				if ( defined(&#039;XMLRPC_REQUEST&#039;) /* || ( defined(&#039;DOING_AJAX&#039;) &amp;&amp; DOING_AJAX ) */ || in_array( $pagenow, $hardway_uris ) || in_array( $plugin_page_cr, $hardway_uris ) || in_array( &quot;p-admin/admin.php?page=$plugin_page_cr&quot;, $hardway_uris ) )
					require_once( dirname(__FILE__).&#039;/hardway/hardway-admin_rs.php&#039; );
        	}
		} // endif is_admin or xmlrpc
	}
	
	
	// add filters which were skipped due to direct file access, but are now needed for the error page display
	function add_main_filters() {
		$is_admin = is_admin();
		$is_administrator = is_content_administrator_rs();
		$disable_queryfilters = defined(&#039;DISABLE_QUERYFILTERS_RS&#039;);
		$frontend_admin = false;
		
		if ( ! defined(&#039;DOING_CRON&#039;) ) {
			if ( $this-&gt;is_front() ) {
				if ( ! $disable_queryfilters )
					require_once( dirname(__FILE__).&#039;/query-interceptor-front_rs.php&#039;);
	
				if ( ! $is_administrator ) {
					require_once( dirname(__FILE__).&#039;/qry-front_non-administrator_rs.php&#039;);
					$GLOBALS[&#039;feed_interceptor&#039;] = new FeedInterceptor_RS(); // file already required in role-scoper.php
				}
	
				require_once( dirname(__FILE__).&#039;/template-interceptor_rs.php&#039;);
				$GLOBALS[&#039;template_interceptor&#039;] = new TemplateInterceptor_RS();
	
				$frontend_admin = ! scoper_get_option(&#039;no_frontend_admin&#039;); // potential performance enhancement	

				if ( ! empty($_REQUEST[&#039;s&#039;]) &amp;&amp; function_exists(&#039;relevanssi_query&#039;) ) {
					require_once( dirname(__FILE__).&#039;/relevanssi-helper-front_rs.php&#039; );
					$rel_helper_rs = new Relevanssi_Search_Filter_RS();
				}
			}

			// ===== Filters which are always loaded (except on plugin scripts), for any access type
			include_once( dirname(__FILE__).&#039;/hardway/wp-patches_agp.php&#039; ); // simple patches for WP
			
			if ( $this-&gt;is_front() || ( &#039;edit.php&#039; == $GLOBALS[&#039;pagenow&#039;] ) ) {
				require_once( dirname(__FILE__).&#039;/query-interceptor-base_rs.php&#039;);
				$GLOBALS[&#039;query_interceptor_base&#039;] = new QueryInterceptorBase_RS();  // listing filter used for role status indication in edit posts/pages and on front end by template functions
			}
		}
		
		// ===== Filters which support automated role maintenance following content creation/update
		// Require an explicitly set option to skip these for front end access, just in case other plugins modify content from the front end.
		if ( ( $is_admin || defined(&#039;XMLRPC_REQUEST&#039;) || $frontend_admin || defined(&#039;DOING_CRON&#039;) ) ) {
			require_once( dirname(__FILE__).&#039;/admin/cache_flush_rs.php&#039; );
			require_once( dirname(__FILE__).&#039;/admin/filters-admin_rs.php&#039; );
			$GLOBALS[&#039;scoper_admin_filters&#039;] = new ScoperAdminFilters();
			
			if ( defined( &#039;RVY_VERSION&#039; ) ) // Support Revisionary references to $scoper-&gt;filters_admin (TODO: eventually phase this out)
				$this-&gt;filters_admin =&amp; $GLOBALS[&#039;scoper_admin_filters&#039;];
		}
		// =====
	}
	

	function init_users_interceptor() {
		if ( ! isset($GLOBALS[&#039;users_interceptor&#039;]) ) {
			require_once( dirname(__FILE__).&#039;/users-interceptor_rs.php&#039;);
			$GLOBALS[&#039;users_interceptor&#039;] = new UsersInterceptor_RS();

			//log_mem_usage_rs( &#039;init Users Interceptor&#039; );
		}
		
		return $GLOBALS[&#039;users_interceptor&#039;];
	}
	
	
	// Primarily for internal use. Drops some features of WP core get_terms while adding the following versatility:
	// - supports any RS-defined taxonomy, with or without WP taxonomy schema
	// - optionally return term_id OR term_taxonomy_id as single column
	// - specify filtered or unfiltered via argument
	// - optionally get terms for a specific object
	// - option to order by term hierarchy (but structure as flat array)
	function get_terms($taxonomy, $filtering = true, $cols = COLS_ALL_RS, $object_id = 0, $args = array()) {
		if ( ! $tx = $this-&gt;taxonomies-&gt;get($taxonomy) )
			return array();

		global $wpdb;

		$defaults = array( &#039;order_by&#039; =&gt; &#039;&#039;, &#039;use_object_roles&#039; =&gt; false, &#039;operation&#039; =&gt; &#039;&#039; ); // IMPORTANT to default operation to nullstring
		$args = array_merge( $defaults, (array) $args );
		extract($args);

		if (  is_administrator_rs( $this-&gt;taxonomies-&gt;member_property( $taxonomy, &#039;object_source&#039; ) ) )
			$filtering = false;

		// try to pull it out of wpcache
		$ckey = md5( $taxonomy . $cols . $object_id . serialize($args) . $order_by );
		
		if ( $filtering ) {
			$src_name = $this-&gt;taxonomies-&gt;member_property($taxonomy, &#039;object_source&#039;, &#039;name&#039;);

			$args[&#039;reqd_caps_by_otype&#039;] = $this-&gt;get_terms_reqd_caps( $taxonomy, $operation, ADMIN_TERMS_FILTER_RS === $filtering );

			$ckey = md5( $ckey . serialize($args[&#039;reqd_caps_by_otype&#039;]) ); ; // can vary based on request URI
		
			global $current_rs_user;
			$cache_flag = &#039;rs_scoper_get_terms&#039;;
			$cache = $current_rs_user-&gt;cache_get($cache_flag);
		} else {			
			$cache_flag = &quot;all_terms&quot;;
			$cache_id = &#039;all&#039;;
			$cache = wpp_cache_get( $cache_id, $cache_flag );
		}

		if ( isset( $cache[ $ckey ] ) ) {
			return $cache[ $ckey ];
		}
			
		// call base class method to build query
		$terms_only = ( ! $filtering || empty($use_object_roles) );
	
		$query_base = $this-&gt;taxonomies-&gt;get_terms_query($taxonomy, $cols, $object_id, $terms_only );

		if ( ! $query_base )
			return array();

		$query = ( $filtering ) ? apply_filters(&#039;terms_request_rs&#039;, $query_base, $taxonomy, $args) : $query_base;

		// avoid sending alarms to SQL purists if this query was not modified by RS filter
		if ( $query_base == $query )
			$query = str_replace( &#039;WHERE 1=1 AND&#039;, &#039;WHERE&#039;, $query );
		
		if ( COL_ID_RS == $cols )
			$results = scoper_get_col($query);
		elseif ( COL_COUNT_RS == $cols )
			$results = intval( scoper_get_var($query) );
		else {
			// TODO: why is this still causing an extra (and costly) scoped query?
			/*
			// for COLS_ALL query, need to call core get_terms call in case another plugin is translating term names
			if ( has_filter( &#039;get_terms&#039;, array(&#039;ScoperHardwayTaxonomy&#039;, &#039;flt_get_terms&#039;) ) ) {
				remove_filter( &#039;get_terms&#039;, array(&#039;ScoperHardwayTaxonomy&#039;, &#039;flt_get_terms&#039;), 1, 3 );
				$all_terms = get_terms($taxonomy);
				add_filter( &#039;get_terms&#039;, array(&#039;ScoperHardwayTaxonomy&#039;, &#039;flt_get_terms&#039;), 1, 3 );

				$term_names = scoper_get_property_array( $all_terms, &#039;term_id&#039;, &#039;name&#039; );
			}
			*/
			
			$results = scoper_get_results($query);

			//scoper_restore_property_array( $results, $term_names, &#039;term_id&#039;, &#039;name&#039; );
				
			if ( ORDERBY_HIERARCHY_RS == $order_by ) {
				require_once( dirname(__FILE__).&#039;/admin/admin_lib_rs.php&#039;);
				
				if ( $src = $this-&gt;data_sources-&gt;get( $tx-&gt;source ) ) {
					if ( ! empty($src-&gt;cols-&gt;id) &amp;&amp; ! empty($src-&gt;cols-&gt;parent) ) {
						require_once( dirname(__FILE__).&#039;/admin/admin_lib-bulk-parent_rs.php&#039;);
						$results = ScoperAdminBulkParent::order_by_hierarchy($results, $src-&gt;cols-&gt;id, $src-&gt;cols-&gt;parent);
					}
				}
			}
		}
		
		$cache[ $ckey ] = $results;

		if ( $results || empty( $_POST ) ) { // todo: why do we get an empty array for unfiltered request for object terms early in POST processing? (on submission of a new post by a contributor)
			if ( $filtering )
				$current_rs_user-&gt;cache_force_set( $cache, $cache_flag );
			else
				wpp_cache_force_set( $cache_id, $cache, $cache_flag );	
		}
		
		return $results;
	}
	
	function get_default_restrictions($scope, $args = array()) {
		$defaults = array( &#039;force_refresh&#039; =&gt; false );
		$args = array_merge( $defaults, (array) $args );
		extract($args);
	
		if ( isset($this-&gt;default_restrictions[$scope]) &amp;&amp; ! $force_refresh )
			return $this-&gt;default_restrictions[$scope];
		
		if ( empty($force_refresh) ) {
			$cache_flag = &quot;rs_{$scope}_def_restrictions&quot;;
			$cache_id = md5(&#039;&#039;);	// maintain default id generation from previous versions

			$default_strict = wpp_cache_get($cache_id, $cache_flag);
		}
		
		if ( $force_refresh || ! is_array($default_strict) ) {
			global $wpdb;
			
			$qry = &quot;SELECT src_or_tx_name, role_name FROM $wpdb-&gt;role_scope_rs WHERE role_type = &#039;rs&#039; AND topic = %s AND max_scope = %s AND obj_or_term_id = &#039;0&#039;&quot;;

			$default_strict = array();
			if ( $results = scoper_get_results( $wpdb-&gt;prepare( $qry, $scope, $scope ) ) ) {
				foreach ( $results as $row ) {
					$role_handle = scoper_get_role_handle($row-&gt;role_name, &#039;rs&#039;);
					$default_strict[$row-&gt;src_or_tx_name][$role_handle] = true;
					
					if (OBJECT_SCOPE_RS == $scope) {
						if ( $objscope_equivalents = $this-&gt;role_defs-&gt;member_property($role_handle, &#039;objscope_equivalents&#039;) )
							foreach ( $objscope_equivalents as $equiv_role_handle )
								$default_strict[$row-&gt;src_or_tx_name][$equiv_role_handle] = true;
					}
					
				}
			}
		}
		
		$this-&gt;default_restrictions[$scope] = $default_strict;

		wpp_cache_set($cache_id, $default_strict, $cache_flag);
		
		return $default_strict;
	}
	
	// for any given role requirement, a strict term is one which won&#039;t blend in blog role assignments
	// (i.e. a term which requires the specified role to be assigned as a term role or object role)
	//
	// returns $arr[&#039;restrictions&#039;][role_handle][obj_or_term_id] = array( &#039;assign_for&#039; =&gt; $row-&gt;assign_for, &#039;inherited_from&#039; =&gt; $row-&gt;inherited_from ),
	//				[&#039;unrestrictions&#039;][role_handle][obj_or_term_id] = array( &#039;assign_for&#039; =&gt; $row-&gt;assign_for, &#039;inherited_from&#039; =&gt; $row-&gt;inherited_from )
	function get_restrictions($scope, $src_or_tx_name, $args = array()) {
		$def_cols = COL_ID_RS;

		// Note: propogating child restrictions are always directly assigned to the child term(s).
		// Use include_child_restrictions to force inclusion of restrictions that are set for child items only,
		// for direct admin of these restrictions and for propagation on term/object creation.
		$defaults = array( 	&#039;id&#039; =&gt; 0,					&#039;include_child_restrictions&#039; =&gt; false,
						 	&#039;force_refresh&#039; =&gt; false, 
						 	&#039;cols&#039; =&gt; $def_cols,		&#039;return_array&#039; =&gt; false );
		$args = array_merge( $defaults, (array) $args );
		extract($args);
		
		$cache_flag = &quot;rs_{$scope}_restrictions_{$src_or_tx_name}&quot;;
		$cache_id = md5($src_or_tx_name . $cols . strval($return_array) . strval($include_child_restrictions) );

		if ( ! $force_refresh ) {
			$items = wpp_cache_get($cache_id, $cache_flag);

			if ( is_array($items) ) {
				if ( $id ) {
					foreach ( $items as $setting_type =&gt; $roles )
						foreach ( array_keys($roles) as $role_handle )
							$items[$setting_type][$role_handle] = array_intersect_key( $items[$setting_type][$role_handle], array( $id =&gt; true ) );
				}

				return $items;
			}
		}
		
		if ( ! isset($this-&gt;default_restrictions[$scope]) )
			$this-&gt;default_restrictions[$scope] = $this-&gt;get_default_restrictions($scope);

		global $wpdb;

		if ( ! empty($this-&gt;default_restrictions[$scope][$src_or_tx_name]) ) {
			if ( $strict_roles = array_keys($this-&gt;default_restrictions[$scope][$src_or_tx_name]) ) {
				if ( OBJECT_SCOPE_RS == $scope ) {
					// apply default_strict handling to objscope equivalents of each strict role
					foreach ( $strict_roles as $role_handle )
						if ( $objscope_equivalents = $this-&gt;role_defs-&gt;member_property($role_handle, &#039;objscope_equivalents&#039;) )
							$strict_roles = array_merge($strict_roles, $objscope_equivalents);
							
					$strict_roles = array_unique($strict_roles);
				}
			}
			
			$strict_role_in = &quot;&#039;&quot; . implode(&quot;&#039;, &#039;&quot;, scoper_role_handles_to_names($strict_roles) ) . &quot;&#039;&quot;;
		} else
			$strict_role_in = &#039;&#039;;
		
		$items = array();				
		if ( ! empty($strict_roles) ) {
			foreach ( $strict_roles as $role_handle )
				$items[&#039;unrestrictions&#039;][$role_handle] = array();  // calling code will use this as an indication that the role is default strict
		}
		
		$default_strict_modes = array( false );
		
		if ( $strict_role_in )
			$default_strict_modes []= true;

		foreach ( $default_strict_modes as $default_strict ) {
			$setting_type = ( $default_strict ) ? &#039;unrestrictions&#039; : &#039;restrictions&#039;;

			if ( TERM_SCOPE_RS == $scope )
				$max_scope = ( $default_strict ) ? &#039;blog&#039; : &#039;term&#039;;  // note: max_scope=&#039;object&#039; entries are treated as separate, overriding requirements
			else
				$max_scope = ( $default_strict ) ? &#039;blog&#039; : &#039;object&#039;; // Storage of &#039;blog&#039; max_scope as object restriction does not eliminate any term restrictions.  It merely indicates, for data sources that are default strict, that this object does not restrict roles
				
			if ( $default_strict )
				$role_clause = &quot;AND role_name IN ($strict_role_in)&quot;;
			elseif ($strict_role_in)
				$role_clause = &quot;AND role_name NOT IN ($strict_role_in)&quot;;
			else
				$role_clause = &#039;&#039;;

			$for_clause = ( $include_child_restrictions ) ? &#039;&#039; : &quot;AND require_for IN (&#039;entity&#039;, &#039;both&#039;)&quot;;
			
			$qry_base = &quot;FROM $wpdb-&gt;role_scope_rs WHERE role_type = &#039;rs&#039; AND topic = %s AND max_scope = %s AND src_or_tx_name = %s $for_clause $role_clause&quot;;
			$qry_base = $wpdb-&gt;prepare( $qry_base, $scope, $max_scope, $src_or_tx_name );
			
			if ( COL_COUNT_RS == $cols )
				$qry = &quot;SELECT role_name, count(obj_or_term_id) AS item_count, require_for $qry_base GROUP BY role_name&quot;;
			else
				$qry = &quot;SELECT role_name, obj_or_term_id, require_for AS assign_for, inherited_from $qry_base&quot;;

			if ( $results = scoper_get_results($qry) ) {
				foreach( $results as $row) {
					$role_handle = scoper_get_role_handle($row-&gt;role_name, &#039;rs&#039;);
					
					if ( COL_COUNT_RS == $cols )
						$items[$setting_type][$role_handle] = $row-&gt;item_count;
					elseif ( $return_array )
						$items[$setting_type][$role_handle][$row-&gt;obj_or_term_id] = array( &#039;assign_for&#039; =&gt; $row-&gt;assign_for, &#039;inherited_from&#039; =&gt; $row-&gt;inherited_from );
					else
						$items[$setting_type][$role_handle][$row-&gt;obj_or_term_id] = $row-&gt;assign_for;
				}
			}
			
		} // end foreach default_strict_mode

		wpp_cache_force_set($cache_id, $items, $cache_flag);

		if ( $id ) {
			foreach ( $items as $setting_type =&gt; $roles )
				foreach ( array_keys($roles) as $role_handle )
					$items[$setting_type][$role_handle] = array_intersect_key( $items[$setting_type][$role_handle], array( $id =&gt; true ) );
		}

		return $items;
	}
	
	
	// wrapper for back-compat with calling code expecting array without date limit dimension
	function qualify_terms($reqd_caps, $taxonomy = &#039;category&#039;, $qualifying_roles = &#039;&#039;, $args = array()) {
		$terms = $this-&gt;qualify_terms_daterange( $reqd_caps, $taxonomy, $qualifying_roles, $args );
		
		if ( isset($terms[&#039;&#039;]) &amp;&amp; is_array($terms[&#039;&#039;]) )
			return $terms[&#039;&#039;];
		else
			return array();
	}

	// $qualifying_roles = array[role_handle] = 1 : qualifying roles
	// returns array of term_ids (terms which have at least one of the qualifying roles assigned)
	function qualify_terms_daterange($reqd_caps, $taxonomy = &#039;category&#039;, $qualifying_roles = &#039;&#039;, $args = array()) {
		$defaults = array( &#039;user&#039; =&gt; &#039;&#039;, &#039;return_id_type&#039; =&gt; COL_ID_RS, &#039;use_blog_roles&#039; =&gt; true, &#039;ignore_restrictions&#039; =&gt; false );

		if ( isset($args[&#039;qualifying_roles&#039;]) )
			unset($args[&#039;qualifying_roles&#039;]);
			
		if ( isset($args[&#039;reqd_caps&#039;]) )
			unset($args[&#039;reqd_caps&#039;]);

		$args = array_merge( $defaults, (array) $args );
		extract($args);

		if ( ! $qualifying_roles )  // calling function might save a little work or limit to a subset of qualifying roles
			$qualifying_roles = $this-&gt;role_defs-&gt;qualify_roles( $reqd_caps );

		if ( ! $this-&gt;taxonomies-&gt;is_member($taxonomy) )
			return array( &#039;&#039; =&gt; array() );
		
		if ( ! is_object($user) ) {
			$user = $GLOBALS[&#039;current_rs_user&#039;];
		}
		
		// If the taxonomy does not require objects to have at least one term, there are no strict terms.
		if ( ! $this-&gt;taxonomies-&gt;member_property($taxonomy, &#039;requires_term&#039;) )
			$ignore_restrictions = true;
			
		if ( ! is_array($qualifying_roles) )
			$qualifying_roles = array($qualifying_roles =&gt; 1);	

		// no need to serialize and md5 the whole user object
		if ( ! empty($user) )
			$args[&#039;user&#039;] = $user-&gt;ID;

		// try to pull previous result out of memcache
		ksort($qualifying_roles);
		$rolereq_key = md5( serialize($reqd_caps) . serialize( array_keys($qualifying_roles) ) . serialize($args) );
		
		if ( isset($user-&gt;qualified_terms[$taxonomy][$rolereq_key]) )
			return $user-&gt;qualified_terms[$taxonomy][$rolereq_key];
			
		if ( ! $qualifying_roles )
			return array( &#039;&#039; =&gt; array() );

		$all_terms = $this-&gt;get_terms($taxonomy, UNFILTERED_RS, COL_ID_RS); // returns term_id, even for WP &gt; 2.3

		if ( ! isset($user-&gt;term_roles[$taxonomy]) )
			$user-&gt;get_term_roles_daterange($taxonomy);  // returns term_id for categories

		$good_terms = array( &#039;&#039; =&gt; array() );
		
		if ( $user-&gt;term_roles[$taxonomy] ) {
			foreach ( array_keys($user-&gt;term_roles[$taxonomy]) as $date_key ) {
				//narrow down to roles which satisfy this call AND are owned by current user
				if ( $good_terms[$date_key] = array_intersect_key( $user-&gt;term_roles[$taxonomy][$date_key], $qualifying_roles ) )
					// flatten from term_roles_terms[role_handle] = array of term_ids
					// to term_roles_terms = array of term_ids
					$good_terms[$date_key] = agp_array_flatten( $good_terms[$date_key] );
			}
		}

		if ( $use_blog_roles ) {
			foreach ( array_keys($user-&gt;blog_roles) as $date_key ) {	
				$user_blog_roles = array_intersect_key( $user-&gt;blog_roles[$date_key], $qualifying_roles );

				// Also include user&#039;s WP blogrole(s) which correspond to the qualifying RS role(s)
				if ( $wp_qualifying_roles = $this-&gt;role_defs-&gt;qualify_roles($reqd_caps, &#039;wp&#039;) ) {
					
					if ( $user_blog_roles_wp = array_intersect_key( $user-&gt;blog_roles[$date_key], $wp_qualifying_roles ) ) {
					
						// Credit user&#039;s qualifying WP blogrole via equivalent RS role(s)
						// so we can also enforce &quot;term restrictions&quot;, which are based on RS roles
						$user_blog_roles_via_wp = $this-&gt;role_defs-&gt;get_contained_roles( array_keys($user_blog_roles_wp), false, &#039;rs&#039; );
						$user_blog_roles_via_wp = array_intersect_key( $user_blog_roles_via_wp, $qualifying_roles );
						$user_blog_roles = array_merge( $user_blog_roles, $user_blog_roles_via_wp );
					}
				}
				
				if ( $user_blog_roles ) {
					if ( empty($ignore_restrictions) ) {
						// array of term_ids that require the specified role to be assigned via taxonomy or object role (user blog caps ignored)
						$strict_terms = $this-&gt;get_restrictions(TERM_SCOPE_RS, $taxonomy);
					} else
						$strict_terms = array();

					foreach ( array_keys($user_blog_roles) as $role_handle ) {
						if ( isset($strict_terms[&#039;restrictions&#039;][$role_handle]) &amp;&amp; is_array($strict_terms[&#039;restrictions&#039;][$role_handle]) )
							$terms_via_this_role = array_diff( $all_terms, array_keys($strict_terms[&#039;restrictions&#039;][$role_handle]) );
						
						elseif ( isset($strict_terms[&#039;unrestrictions&#039;][$role_handle]) &amp;&amp; is_array($strict_terms[&#039;unrestrictions&#039;][$role_handle]) )
							$terms_via_this_role = array_intersect( $all_terms, array_keys( $strict_terms[&#039;unrestrictions&#039;][$role_handle] ) );
						
						else
							$terms_via_this_role = $all_terms;
	
						if( $good_terms[$date_key] )
							$good_terms[$date_key] = array_merge( $good_terms[$date_key], $terms_via_this_role );
						else
							$good_terms[$date_key] = $terms_via_this_role;
					}
				}
			}
		}

		foreach ( array_keys($good_terms) as $date_key ) {
			if ( $good_terms[$date_key] = array_intersect( $good_terms[$date_key], $all_terms ) )  // prevent orphaned category roles from skewing access
				$good_terms[$date_key] = array_unique( $good_terms[$date_key] );
		
			// if COL_TAXONOMY_ID_RS, return a term_taxonomy_id instead of term_id
			if ( $good_terms[$date_key] &amp;&amp; (COL_TAXONOMY_ID_RS == $return_id_type) &amp;&amp; taxonomy_exists($taxonomy) ) {
				$all_terms_cols = $this-&gt;get_terms( $taxonomy, UNFILTERED_RS );
				$good_tt_ids = array();
				foreach ( $good_terms[$date_key] as $term_id )
					foreach ( array_keys($all_terms_cols) as $termkey )
						if ( $all_terms_cols[$termkey]-&gt;term_id == $term_id ) {
							$good_tt_ids []= $all_terms_cols[$termkey]-&gt;term_taxonomy_id;
							break;
						}
						
				$good_terms[$date_key] = $good_tt_ids;
			}
		}
		
		$user-&gt;qualified_terms[$taxonomy][$rolereq_key] = $good_terms;

		return $good_terms;
	}
	
	// account for different contexts of get_terms calls 
	// (Scoped roles can dictate different results for front end, edit page/post, manage categories)
	function get_terms_reqd_caps( $taxonomy, $operation = &#039;&#039;, $is_term_admin = false ) {
		global $pagenow;

		if ( ! $src_name = $this-&gt;taxonomies-&gt;member_property( $taxonomy, &#039;object_source&#039; ) ) {
			if ( taxonomy_exists( $taxonomy ) )
				$src_name = &#039;post&#039;;
		}

		$return_caps = array();

		$is_term_admin = $is_term_admin 
		|| in_array( $pagenow, array( &#039;edit-tags.php&#039; ) ) 
		|| ( &#039;nav_menu&#039; == $taxonomy &amp;&amp; ( &#039;nav-menus.php&#039; == $pagenow ) 
		|| ( ( &#039;admin-ajax.php&#039; == $pagenow ) &amp;&amp; ( ! empty($_REQUEST[&#039;action&#039;]) &amp;&amp; in_array( $_REQUEST[&#039;action&#039;], array( &#039;add-menu-item&#039;, &#039;menu-locations-save&#039; ) ) ) )
		);	// possible TODO: abstract for non-WP taxonomies

		if ( $is_term_admin ) {
			// query pertains to the management of terms
			if ( &#039;post&#039; == $src_name ) {
				$taxonomy_obj = get_taxonomy( $taxonomy );
				$return_caps[$taxonomy] = array( $taxonomy_obj-&gt;cap-&gt;manage_terms );
			} elseif ( &#039;link_category&#039; == $taxonomy ) { 
				$return_caps[$taxonomy] = array( &#039;manage_categories&#039; );
			} else {
				global $scoper;
				$cap_defs = $scoper-&gt;cap_defs-&gt;get_matching( $src_name, $taxonomy, OP_ADMIN_RS );
				$return_caps[$taxonomy] = $cap_defs ? array_keys( $cap_defs ) : array();
			}

		} else {
			// query pertains to reading or editing content within certain terms, or adding terms to content
			
			$base_caps_only = true;
			
			if ( &#039;post&#039; == $src_name ) {
				if ( ! $operation )
					$operation = ( $this-&gt;is_front() || ( &#039;profile.php&#039; == $pagenow ) || ( is_admin() &amp;&amp; array_key_exists(&#039;plugin_page&#039;, $GLOBALS) &amp;&amp; ( &#039;s2&#039; == $GLOBALS[&#039;plugin_page&#039;] ) ) ) ? &#039;read&#039; : &#039;edit&#039;;  // hack to support subscribe2 categories checklist

				$status = ( &#039;read&#039; == $operation ) ? &#039;publish&#039; : &#039;draft&#039;;
				
				// terms query should be limited to a single object type for post.php, post-new.php, so only return caps for that object type (TODO: do this in wp-admin regardless of URI ?)
				if ( in_array( $pagenow, array( &#039;post.php&#039;, &#039;post-new.php&#039; ) ) )
					$object_type = cr_find_post_type();
			} else {
				if ( ! $operation )
					$operation = ( $this-&gt;is_front() ) ? &#039;read&#039; : &#039;edit&#039;;

				$status = &#039;&#039;;
			}
				
			// The return array will indicate term role enable / disable, as well as associated capabilities
			if ( ! empty($object_type) )
				$check_object_types = array( $object_type );
			else {
				if ( $check_object_types = (array) $this-&gt;data_sources-&gt;member_property( $src_name, &#039;object_types&#039; ) )
					$check_object_types = array_keys( $check_object_types );
			}
				
			if ( &#039;post&#039; == $src_name )
				$use_post_types = scoper_get_option( &#039;use_post_types&#039; );	
			
			$enabled_object_types = array();
			foreach ( $check_object_types as $_object_type ) {
				if ( $use_term_roles = scoper_get_otype_option( &#039;use_term_roles&#039;, $src_name, $_object_type ) )
					if ( ! empty( $use_term_roles[$taxonomy] ) ) {
						if ( ( &#039;post&#039; != $src_name ) || ! empty( $use_post_types[$_object_type] ) )
							$enabled_object_types []= $_object_type;
					}
			}

			foreach( $enabled_object_types as $object_type )
				$return_caps[$object_type] = cr_get_reqd_caps( $src_name, $operation, $object_type, $status, $base_caps_only );	
		}
		
		return $return_caps;
	}
	
	function users_who_can($reqd_caps, $cols = COLS_ALL_RS, $object_src_name = &#039;&#039;, $object_id = 0, $args = array() ) {
		// if there are not capability requirements, no need to load Users_Interceptor filtering class
		if ( ! $reqd_caps ) {
			if ( COL_ID_RS == $cols )
				$qcols = &#039;ID&#039;;
			elseif ( COLS_ID_NAME_RS == $cols )
				$qcols = &quot;ID, user_login AS display_name&quot;;	// calling code assumes display_name property for user or group object
			elseif ( COLS_ID_DISPLAYNAME_RS == $cols )
				$qcols = &quot;ID, display_name&quot;;
			elseif ( COLS_ALL_RS == $cols )
				$qcols = &quot;*&quot;;
			else
				$qcols = $cols;
				
			global $wpdb;
				
			$orderby = ( $cols == COL_ID_RS ) ? &#039;&#039; : &#039;ORDER BY display_name&#039;;

			if ( IS_MU_RS &amp;&amp; ! scoper_get_option( &#039;mu_sitewide_groups&#039; ) &amp;&amp; ! defined( &#039;FORCE_ALL_SITE_USERS_RS&#039; ) )
				$qry = &quot;SELECT $qcols FROM $wpdb-&gt;users INNER JOIN $wpdb-&gt;usermeta AS um ON $wpdb-&gt;users.ID = um.user_id AND um.meta_key = &#039;{$wpdb-&gt;prefix}capabilities&#039; $orderby&quot;;
			else
				$qry = &quot;SELECT $qcols FROM $wpdb-&gt;users $orderby&quot;;

			if ( COL_ID_RS == $cols )
				return scoper_get_col( $qry );
			else
				return scoper_get_results( $qry );	
			
		} else {
			$defaults = array( &#039;where&#039; =&gt; &#039;&#039;, &#039;orderby&#039; =&gt; &#039;&#039;, &#039;disable_memcache&#039; =&gt; false, &#039;group_ids&#039; =&gt; &#039;&#039;, &#039;force_refresh&#039; =&gt; false, &#039;force_all_users&#039; =&gt; false );
			$args = array_merge( $defaults, (array) $args );
			extract($args);
	
			$cache_flag = &quot;rs_users_who_can&quot;;
			$cache_id = md5(serialize($reqd_caps) . $cols . &#039;src&#039; . $object_src_name . &#039;id&#039; . $object_id . serialize($args) );
		
			if ( ! $force_refresh ) {
				// if we already have the results cached, no need to load Users_Interceptor filtering class
				$users = wpp_cache_get($cache_id, $cache_flag);
	
				if ( is_array($users) )
					return $users;
			}
			
			$this-&gt;init_users_interceptor();
			$users = $GLOBALS[&#039;users_interceptor&#039;]-&gt;users_who_can($reqd_caps, $cols, $object_src_name, $object_id, $args );

			wpp_cache_set($cache_id, $users, $cache_flag);
			return $users;
		}
	}
	
	function groups_who_can($reqd_caps, $cols = COLS_ALL_RS, $object_src_name = &#039;&#039;, $object_id = 0, $args = array() ) {
		$this-&gt;init_users_interceptor();
		return $GLOBALS[&#039;users_interceptor&#039;]-&gt;groups_who_can($reqd_caps, $cols, $object_src_name, $object_id, $args );
	}
	
	function is_front() {
		return ( defined(&#039;CURRENT_ACCESS_NAME_RS&#039;) &amp;&amp; ( &#039;front&#039; == CURRENT_ACCESS_NAME_RS ) );
	}
	
	
	// returns array of role names which have the required caps (or their basecap equivalent)
	// AND have been applied to at least one object, for any user or group
	function qualify_object_roles( $reqd_caps, $object_type = &#039;&#039;, $user = &#039;&#039;, $base_caps_only = false ) {
		$roles = array();

		if ( $base_caps_only )
			$reqd_caps = $this-&gt;cap_defs-&gt;get_base_caps($reqd_caps);

		$roles = $this-&gt;role_defs-&gt;qualify_roles($reqd_caps, &#039;rs&#039;, $object_type);

		return $this-&gt;confirm_object_scope( $roles, $user );
	}

	// $roles[$role_handle] = array
	// returns arr[$role_handle] 
	function confirm_object_scope( $roles, $user = &#039;&#039; ) {
		foreach ( array_keys($roles) as $role_handle ) {
			if ( empty( $this-&gt;role_defs-&gt;members[$role_handle]-&gt;valid_scopes[&#039;object&#039;] ) )
				unset( $roles[$role_handle] );
		}

		if ( ! $roles )
			return array();
		
		if ( is_object($user) )
			$applied_obj_roles = $this-&gt;get_applied_object_roles( $user );
		elseif ( empty($user) ) {
			$applied_obj_roles = $this-&gt;get_applied_object_roles( $GLOBALS[&#039;current_rs_user&#039;] );
		} else // -1 value passed to indicate check for all users
			$applied_obj_roles = $this-&gt;get_applied_object_roles();
			
		return array_intersect_key( $roles, $applied_obj_roles );	
	}
	
	
	// returns array of role_handles which have been applied to any object
	// if $user arg is supplied, returns only roles applied for that user (or that user&#039;s groups) 
	function get_applied_object_roles( $user = &#039;&#039; ) {
		if ( is_object( $user ) ) {
			$cache_flag = &#039;rs_object-roles&#039;;			// v 1.1: changed cache key from &quot;object_roles&quot; to &quot;object-roles&quot; to match new key format for blog, term roles
			$cache = $user-&gt;cache_get($cache_flag);
			
			$limit = &#039;&#039;;
			$u_g_clause = $user-&gt;get_user_clause(&#039;&#039;);
		} else {
			$cache_flag = &#039;rs_applied_object-roles&#039;;	// v 1.1: changed cache key from &quot;object_roles&quot; to &quot;object-roles&quot; to match new key format for blog, term roles
			$cache_id = &#039;all&#039;;
			$cache = wpp_cache_get($cache_id, $cache_flag);
			
			$u_g_clause = &#039;&#039;;
		}
		
		if ( is_array($cache) )
			return $cache;
		
		$role_handles = array();
			
		global $wpdb;
		
		// object roles support date limits, but content date limits (would be redundant and a needless performance hit)
		$duration_clause = scoper_get_duration_clause( &#039;&#039;, $wpdb-&gt;user2role2object_rs );

		if ( $role_names = scoper_get_col(&quot;SELECT DISTINCT role_name FROM $wpdb-&gt;user2role2object_rs WHERE role_type=&#039;rs&#039; AND scope=&#039;object&#039; $duration_clause $u_g_clause&quot;) )
			$role_handles = scoper_role_names_to_handles($role_names, &#039;rs&#039;, true); //arg: return role keys as array key
		
		if ( is_object($user) ) {
			$user-&gt;cache_force_set($role_handles, $cache_flag);
		} else
			wpp_cache_force_set($cache_id, $role_handles, $cache_flag);
		
		return $role_handles;
	}
	
	function user_can_edit_blogwide( $src_name = &#039;&#039;, $object_type = &#039;&#039;, $args = &#039;&#039; ) {
		if ( is_administrator_rs($src_name) )
			return true;
	
		require_once( dirname(__FILE__).&#039;/admin/permission_lib_rs.php&#039; );
		return user_can_edit_blogwide_rs($src_name, $object_type, $args);
	}
	
} // end Scoper class


// (needed to stop using shared core library function with Revisionary due to changes in meta_flag handling)
if ( ! function_exists(&#039;awp_user_can&#039;) ) {
function awp_user_can( $reqd_caps, $object_id = 0, $user_id = 0, $meta_flags = array() ) {	
	return cr_user_can( $reqd_caps, $object_id, $user_id, $meta_flags );
}
}

// equivalent to current_user_can, 
// except it supports array of reqd_caps, supports non-current user, and does not support numeric reqd_caps
function cr_user_can( $reqd_caps, $object_id = 0, $user_id = 0, $meta_flags = array() ) {	
	if ( ! $user_id ) {
		if ( function_exists(&#039;is_super_admin&#039;) &amp;&amp; is_super_admin() ) 
			return true;
			
		if ( is_content_administrator_rs() || ! function_exists( &#039;_cr_user_can&#039; ) )
			return current_user_can( $reqd_caps );
	}

	if ( function_exists( &#039;_cr_user_can&#039; ) )
		return _cr_user_can( $reqd_caps, $object_id, $user_id, $meta_flags );
}

?&gt;</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fwww%2F4xpips.net%2Fwp-content%2Foff-plugins%2Frole-scoper'>⬅ Back to Directory</a>