Ticket #2329: prevent_private_group_funny_business.patch

bp-core/bp-core-classes.php

@@ -151 +151 @@
                                 $sql['where_users'] = "AND u.ID IN ({$uids})";
                 }
 
-                else if ( $user_id && function_exists( 'friends_install' ) ) {
+                else if ( $user_id && bp_is_active( 'friends' ) ) {
                         $friend_ids = friends_get_friend_user_ids( $user_id );
                         $friend_ids = $wpdb->escape( implode( ',', (array)$friend_ids ) );
 

bp-groups.php

@@ -136 +136 @@
                         bp_core_new_subnav_item( array( 'name' => sprintf( __( 'Members (%s)', 'buddypress' ), number_format( $bp->groups->current_group->total_member_count ) ), 'slug' => 'members', 'parent_url' => $group_link, 'parent_slug' => $bp->groups->slug, 'screen_function' => 'groups_screen_group_members', 'position' => 60, 'user_has_access' => $bp->groups->current_group->user_has_access, 'item_css_id' => 'members'  ) );
 
                         if ( is_user_logged_in() && groups_is_user_member( $bp->loggedin_user->id, $bp->groups->current_group->id ) ) {
-                                if ( function_exists('friends_install') )
+                                if ( bp_is_active('friends') )
                                         bp_core_new_subnav_item( array( 'name' => __( 'Send Invites', 'buddypress' ), 'slug' => 'send-invites', 'parent_url' => $group_link, 'parent_slug' => $bp->groups->slug, 'screen_function' => 'groups_screen_group_invite', 'item_css_id' => 'invite', 'position' => 70, 'user_has_access' => $bp->groups->current_group->user_has_access ) );
                         }
                 }
@@ -1110 +1110 @@
 
         if ( !$bp->is_single_item || $bp->current_component != $bp->groups->slug || $bp->current_action != 'join' )
                 return false;
+        
+        if ( $bp->groups->current_group->status != 'public' ) {
+                if ( !groups_check_user_has_invite( $bp->loggedin_user->id, $bp->groups->current_group->id ) ) {
+                        bp_core_add_message( __( 'There was an error joining the group.', 'buddypress' ), 'error' );
+                        bp_core_redirect( bp_get_group_permalink( $bp->groups->current_group ) );
+                }
+        }
 
         // user wants to join a group
         if ( !groups_is_user_member( $bp->loggedin_user->id, $bp->groups->current_group->id ) && !groups_is_user_banned( $bp->loggedin_user->id, $bp->groups->current_group->id ) ) {