Ticket #5623: 5623.patch

src/bp-members/bp-members-admin.php

@@ -108 +108 @@
                 // The Edit Profile Screen id
                 $this->user_page = '';
 
+                // The Show Profile Screen id
+                $this->user_profile    = bp_current_user_can( 'bp_moderate' ) ? 'users' : 'profile';
+                $this->is_self_profile = false;
+
+                // The current user id
+                $this->current_user_id = get_current_user_id(); 
+
                 // The screen ids to load specific css for
                 $this->screen_id = array();
 
                 // The stats metabox default position
                 $this->stats_metabox = new StdClass();
 
-                // The WordPress edit user url
-                $this->edit_url = bp_get_admin_url( 'user-edit.php' );
-
-                // BuddyPress edit user's profile url
-                $this->edit_profile_url = add_query_arg( 'page', 'bp-profile-edit', bp_get_admin_url( 'users.php' ) );
+                // BuddyPress edit user's profile args
+                $this->edit_profile_args = array( 'page' => 'bp-profile-edit' );
+                $this->edit_profile_url = '';
+                $this->edit_url = '';
 
                 // Data specific to signups
                 $this->users_page   = '';
@@ -151 +157 @@
                 // Add menu item to all users menu
                 add_action( bp_core_admin_hook(),       array( $this, 'admin_menus'     ),   5    );
 
+                // In multisite we'll use this hook to be sure every member 
+                // can access their wp-admin/extended profile
+                add_action( 'user_admin_menu',          array( $this, 'user_profile_menu' ), 5    );
+
                 // Enqueue all admin JS and CSS
                 add_action( 'bp_admin_enqueue_scripts', array( $this, 'enqueue_scripts' )         );
 
                 // Create the Profile Navigation (Profile/Extended Profile)
                 add_action( 'edit_user_profile',        array( $this, 'profile_nav'     ),  99, 1 );
+                add_action( 'show_user_profile',        array( $this, 'profile_nav'     ),  99, 1 );
 
                 // Add a row action to users listing
-                add_filter( bp_core_do_network_admin() ? 'ms_user_row_actions' : 'user_row_actions', array( $this, 'row_actions' ), 10, 2 );
+                if ( bp_core_do_network_admin() ) {
+                        add_filter( 'ms_user_row_actions',        array( $this, 'row_actions'                    ), 10, 2 );
+                        add_action( 'admin_init',                 array( $this, 'add_edit_profile_url_filter'    )        );
+                        add_action( 'wp_after_admin_bar_render',  array( $this, 'remove_edit_profile_url_filter' )        );
+                } else {
+                        add_filter( 'user_row_actions',           array( $this, 'row_actions'                    ), 10, 2 );
+                }
 
                 /** Signups **************************************************************/
 
@@ -176 +193 @@
         }
 
         /**
-         * Create the All Users > Edit Profile and Signups submenus.
+         * Create the self admin Profile submenus for members.
+         *
+         * @access public
+         * @since BuddyPress (2.1.0)
+         *
+         * @uses add_submenu_page() To add the Edit Profile page in Profile section.
+         */
+        public function user_profile_menu() {
+                $hooks['user'] = $this->user_page = add_submenu_page(
+                        'profile.php',
+                        __( 'Edit Profile',  'buddypress' ),
+                        __( 'Edit Profile',  'buddypress' ),
+                        'exist',
+                        'bp-profile-edit',
+                        array( &$this, 'user_admin' )
+                );
+
+                $this->screen_id = array( $this->user_page . '-user', $this->user_profile .'-user' );
+
+                foreach ( $hooks as $key => $hook ) {
+                        add_action( "load-$hook", array( $this, $key . '_admin_load' ) );
+                }
+
+                add_action( "admin_head-$this->user_page", array( $this, 'profile_admin_head' ) );
+                add_action( "admin_head-profile.php",      array( $this, 'profile_admin_head' ) );
+        }
+
+        /**
+         * Create the All Users / Profile > Edit Profile and All Users Signups submenus.
          *
          * @access public
          * @since BuddyPress (2.0.0)
          *
-         * @uses add_users_page() To add the Edit Profile page in Users section.
+         * @uses add_submenu_page() To add the Edit Profile page in Users/Profile section.
          */
         public function admin_menus() {
 
                 // Manage user's profile
-                $hooks['user'] = $this->user_page = add_users_page(
+                $hooks['user'] = $this->user_page = add_submenu_page(
+                        $this->user_profile . '.php',
                         __( 'Edit Profile',  'buddypress' ),
                         __( 'Edit Profile',  'buddypress' ),
-                        'bp_moderate',
+                        'read',
                         'bp-profile-edit',
                         array( &$this, 'user_admin' )
                 );
@@ -203 +249 @@
                         array( &$this, 'signups_admin' )
                 );
 
-                $edit_page = 'user-edit';
-                $this->users_page = 'users';
+                $edit_page         = 'user-edit';
+                $profile_page      = 'profile';
+                $this->users_page  = 'users';
+
+                // Self profile check is needed for this pages
+                $page_head = array(
+                        $this->user_page,
+                        $profile_page . '.php',
+                        $this->users_page . '.php',
+                        $edit_page . '.php',
+                );
 
                 if ( bp_core_do_network_admin() ) {
                         $edit_page          .= '-network';
                         $this->users_page   .= '-network';
                         $this->user_page    .= '-network';
+                        $profile_page       .= '-network';
                         $this->signups_page .= '-network';
                 }
 
-                $this->screen_id = array( $edit_page, $this->user_page );
+                $this->screen_id = array( $edit_page, $this->user_page, $profile_page );
 
                 foreach ( $hooks as $key => $hook ) {
                         add_action( "load-$hook", array( $this, $key . '_admin_load' ) );
                 }
 
-                add_action( "admin_head-$this->user_page", array( $this, 'modify_admin_menu_highlight' ) );
+                foreach ( $page_head as $head ) {
+                        add_action( "admin_head-$head", array( $this, 'profile_admin_head' ) );
+                }
 
         }
 
         /**
          * Highlight the Users menu if on Edit Profile.
-         *
+         * 
+         * + Check if on the user's admin profile
+         * 
          * @access public
-         * @since BuddyPress (2.0.0)
+         * @since BuddyPress (2.1.0)
          */
-        public function modify_admin_menu_highlight() {
+        public function profile_admin_head() {
                 global $plugin_page, $submenu_file;
 
+                // Is the user editing his profile ?
+                if ( defined( 'IS_PROFILE_PAGE' ) && IS_PROFILE_PAGE ) {
+                        $this->is_self_profile = true;
+                } else if ( ! empty( $_GET['user_id'] ) ) {
+                        $this->is_self_profile = $_GET['user_id'] == $this->current_user_id ? true : false ;
+                }
+
+                $users_page = $this->user_profile . '.php';
+                $edit_page = 'user-edit.php';
+
+                if ( ! empty( $this->is_self_profile ) ) {
+                        $edit_page = 'profile.php';
+                }
+
+                // Super Admins on bp_core_do_network_admin() configs and all users for other ones
+                if ( ! is_user_admin() ) {
+                        $this->edit_profile_url = add_query_arg( $this->edit_profile_args, bp_get_admin_url( $users_page ) );
+                        $this->edit_url         = bp_get_admin_url( $edit_page );
+
+                // On multisite configs, using user_admin_url will display the extended profile for each member
+                // This is possible thanks to $this->filter_adminbar_profile_link() filter 
+                } else {
+                        $this->edit_profile_url = add_query_arg( $this->edit_profile_args, user_admin_url( $users_page ) );
+                        $this->edit_url         = user_admin_url( $edit_page );
+                }
+
                 // Only Show the All users menu
-                if ( $plugin_page = 'bp-profile-edit' ) {
-                        $submenu_file = 'users.php';
+                if ( $plugin_page == 'bp-profile-edit' ) {
+                        $submenu_file = ! bp_core_do_network_admin() && ! empty( $this->is_self_profile ) ? 'profile.php' : $users_page;
                 }
         }
 
@@ -249 +335 @@
          * @since BuddyPress (2.0.0)
          */
         public function admin_head() {
-                // Remove submenu to force using Profile Navigation
                 remove_submenu_page( 'users.php', 'bp-profile-edit' );
+                remove_submenu_page( 'profile.php', 'bp-profile-edit' );
         }
 
         /** Community Profile ************************************************/
@@ -284 +370 @@
         }
 
         /**
+         * Should we display the profile nav in this admin area ?
+         *
+         * @access public
+         * @since BuddyPress (2.1.0)
+         */
+        public function do_profile_nav() {
+                $retval = false;
+
+                if ( bp_core_do_network_admin() ) {
+                        $retval = is_user_admin() ? is_user_admin() : is_network_admin();
+                } else {
+                        $retval = is_admin();
+                }
+
+                return $retval;
+        }
+
+        /**
          * Create the Profile navigation in Edit User & Edit Profile pages.
          *
          * @access public
@@ -297 +401 @@
 
                 // Don't display here if this is not where other BP
                 // administration takes place
-                if ( bp_core_do_network_admin() && ! is_network_admin() ) {
+                if ( ! $this->do_profile_nav() ) {
                         return;
                 }
 
@@ -310 +414 @@
                 $community_url = add_query_arg( $query_args, $this->edit_profile_url );
                 $wordpress_url = add_query_arg( $query_args, $this->edit_url         );
 
+                if (  $this->is_self_profile ) {
+                        $wordpress_url = remove_query_arg( 'user_id', $wordpress_url );
+                }
+
                 $bp_active = false;
                 $wp_active = ' nav-tab-active';
                 if ( 'BuddyPress' === $active ) {
@@ -325 +433 @@
                          * this check.
                          */
                         ?>
-                        <?php if ( current_user_can( 'edit_user' ) ) :?>
+                        <?php if ( ! empty( $this->is_self_profile ) || current_user_can( 'edit_user' ) ) :?>
                                 <li class="nav-tab<?php echo esc_attr( $wp_active ); ?>"><a href="<?php echo esc_url( $wordpress_url );?>"><?php _e( 'Profile', 'buddypress' ); ?></a></li>
                         <?php endif ;?>
                         <li class="nav-tab<?php echo esc_attr( $bp_active ); ?>"><a href="<?php echo esc_url( $community_url );?>"><?php _e( 'Extended Profile', 'buddypress' ); ?></a></li>
@@ -337 +445 @@
         }
 
         /**
+         * Can the current user edit the one displayed
+         * 
+         * self profile editing / or bp_moderate check.
+         * This might be replaced by more granular capabilities
+         * in the future.
+         *
+         * @access public
+         * @since BuddyPress (2.1.0)
+         */
+        public function member_can_edit( $user_id = 0 ) {
+                $retval = false;
+
+                if ( empty( $user_id ) )
+                        return $retval;
+
+                if ( $this->current_user_id == $user_id ) {
+                        $retval = true;
+
+                } else {
+                        // Make sure a regular admin cannot edit a Super Admin
+                        if ( is_super_admin( $user_id ) ) {
+                                $retval = false;
+                        // Default to bp_moderate
+                        } else {
+                                $retval = bp_current_user_can( 'bp_moderate' );
+                        }
+                }
+
+                return $retval;
+        }
+
+        /**
          * Set up the user's profile admin page.
          *
          * Loaded before the page is rendered, this function does all initial
@@ -347 +487 @@
          * @since BuddyPress (2.0.0)
          */
         public function user_admin_load() {
-
                 if ( ! $user_id = intval( $_GET['user_id'] ) ) {
                         wp_die( __( 'No users were found', 'buddypress' ) );
                 }
 
-                // only edit others profile
-                if ( get_current_user_id() == $user_id ) {
-                        bp_core_redirect( get_edit_user_link( $user_id ) );
+                // Used for custom metabox and to disallow spam/unspam actions
+                $self_profile = $user_id == $this->current_user_id ? true : false;
+
+                // can current user edit this profile ?
+                if ( ! $this->member_can_edit( $user_id ) ) {
+                        wp_die( __( 'You cannot edit the requested user.', 'buddypress' ) );
                 }
 
                 // Build redirection URL
@@ -417 +559 @@
                         // User Stat metabox
                         add_meta_box( 'bp_members_admin_user_stats',    _x( 'Stats' . $display_name, 'members user-admin edit screen', 'buddypress' ), array( &$this, 'user_admin_stats_metabox' ), get_current_screen()->id, sanitize_key( $this->stats_metabox->context ), sanitize_key( $this->stats_metabox->priority ) );
 
-                        // Custom metabox ?
-                        do_action( 'bp_members_admin_user_metaboxes' );
+                        /**
+                         * Custom metabox ?
+                         * Plugins can restrict metabox to "bp_moderate" admins checking
+                         * the first argument ($self_profile) is false in their hook
+                         * They can also restruct their metabox to self profile editing
+                         * by cheking it set to true.
+                         */
+                        do_action( 'bp_members_admin_user_metaboxes', $self_profile, $user_id );
 
                         // Enqueue javascripts
                         wp_enqueue_script( 'postbox' );
                         wp_enqueue_script( 'dashboard' );
 
                 // Spam or Ham user
-                } else if ( in_array( $doaction, array( 'spam', 'ham' ) ) ) {
+                } else if ( in_array( $doaction, array( 'spam', 'ham' ) ) && empty( $self_profile ) ) {
 
                         check_admin_referer( 'edit-bp-profile_' . $user_id );
 
@@ -455 +603 @@
          */
         public function user_admin() {
 
-                if ( ! current_user_can( 'bp_moderate' ) ) {
+                if ( ! current_user_can( 'bp_moderate' ) && empty( $this->is_self_profile ) ) {
                         die( '-1' );
                 }
 
                 $user = get_user_to_edit( $_GET['user_id'] );
 
+                // Construct title
+                $title = __( 'Edit User', 'buddypress' );
+                if ( ! empty( $this->is_self_profile ) ) {
+                        $title = __( 'Profile', 'buddypress' );
+                }
+
                 // Construct URL for form
                 $form_url        = remove_query_arg( array( 'action', 'error', 'updated', 'spam', 'ham' ), $_SERVER['REQUEST_URI'] );
                 $form_url        = esc_url( add_query_arg( 'action', 'update', $form_url ) );
-                $wp_http_referer = remove_query_arg( array( 'action', 'updated' ), $_REQUEST['wp_http_referer'] );
+                $wp_http_referer = false;
+                if ( ! empty( $_REQUEST['wp_http_referer'] ) )
+                        $wp_http_referer = remove_query_arg( array( 'action', 'updated' ), $_REQUEST['wp_http_referer'] );
 
                 // Prepare notice for admin
                 $notice = array();
@@ -556 +712 @@
                         <?php screen_icon( 'users' ); ?>
                         <h2>
                                 <?php
-                                _e( 'Edit User', 'buddypress' );
-                                if ( current_user_can( 'create_users' ) ) { ?>
-                                        <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add New', 'user', 'buddypress' ); ?></a>
-                                <?php } elseif ( is_multisite() && current_user_can( 'promote_users' ) ) { ?>
-                                        <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add Existing', 'user', 'buddypress' ); ?></a>
-                                <?php }
+                                echo esc_html( $title );
+                                if ( empty( $this->is_self_profile ) ) {
+                                        if ( current_user_can( 'create_users' ) ) { ?>
+                                                <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add New', 'user', 'buddypress' ); ?></a>
+                                        <?php } elseif ( is_multisite() && current_user_can( 'promote_users' ) ) { ?>
+                                                <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add Existing', 'user', 'buddypress' ); ?></a>
+                                        <?php }
+                                }
                                 ?>
                         </h2>
 
@@ -631 +789 @@
                         <div id="minor-publishing">
                                 <div id="misc-publishing-actions">
                                         <?php
+                                        // If a user is editing his profile, let's not show the spam/unspam controls
+                                        if ( empty( $this->is_self_profile ) ) :
                                         /**
                                          * In configs where BuddyPress is not network activated, regular admins
                                          * cannot mark a user as a spammer on front end. This prevent them to do
                                          * it in backend.
                                          */
                                         ?>
-                                        <?php if ( empty( $this->subsite_activated ) || ( ! empty( $this->subsite_activated ) && current_user_can( 'manage_network_users' ) ) ) : ?>
-                                                <div class="misc-pub-section" id="comment-status-radio">
-                                                        <label class="approved"><input type="radio" name="user_status" value="ham" <?php checked( bp_is_user_spammer( $user->ID ), false ); ?>><?php esc_html_e( 'Active', 'buddypress' ); ?></label><br />
-                                                        <label class="spam"><input type="radio" name="user_status" value="spam" <?php checked( bp_is_user_spammer( $user->ID ), true ); ?>><?php esc_html_e( 'Spammer', 'buddypress' ); ?></label>
-                                                </div>
+                                                <?php if ( empty( $this->subsite_activated ) || ( ! empty( $this->subsite_activated ) && current_user_can( 'manage_network_users' ) ) ) : ?>
+                                                        <div class="misc-pub-section" id="comment-status-radio">
+                                                                <label class="approved"><input type="radio" name="user_status" value="ham" <?php checked( bp_is_user_spammer( $user->ID ), false ); ?>><?php esc_html_e( 'Active', 'buddypress' ); ?></label><br />
+                                                                <label class="spam"><input type="radio" name="user_status" value="spam" <?php checked( bp_is_user_spammer( $user->ID ), true ); ?>><?php esc_html_e( 'Spammer', 'buddypress' ); ?></label>
+                                                        </div>
+                                                <?php endif ;?>
                                         <?php endif ;?>
 
                                         <div class="misc-pub-section curtime misc-pub-section-last">
@@ -736 +897 @@
          * @return array Merged actions.
          */
         public function row_actions( $actions = '', $user = null ) {
-                // only edit others profile
-                if ( get_current_user_id() == $user->ID ) {
-                        return $actions;
-                }
 
                 // Prevent a regular admin to edit a super admin
-                if( in_array( $user->user_login, get_super_admins() ) ) {
+                if( in_array( $user->user_login, get_super_admins() ) && $user->ID != $this->current_user_id ) {
                         return $actions;
                 }
 
@@ -773 +930 @@
                 return array_merge( $new_edit_actions, $actions );
         }
 
+        /**
+         * Add a filter to edit profile url in WP Admin Bar
+         * 
+         * @access public
+         * @since BuddyPress (2.1.0)
+         */
+        public function add_edit_profile_url_filter() {
+                add_filter( 'bp_members_edit_profile_url', array( $this, 'filter_adminbar_profile_link' ), 10, 3 );
+        }
+
+        /**
+         * Filter the profile url
+         * 
+         * @access public
+         * @since BuddyPress (2.1.0)
+         * 
+         * @uses  user_admin_url()
+         */
+        public function filter_adminbar_profile_link( $profile_link = '', $url = '', $user_id = 0 ) {
+                if( ! is_super_admin( $user_id ) && is_admin() ) {
+                        $profile_link = user_admin_url( 'profile.php' );
+                }
+                return $profile_link;
+        }
+
+        /**
+         * Remove the filter to edit profile url in WP Admin Bar
+         * 
+         * @access public
+         * @since BuddyPress (2.1.0)
+         */
+        public function remove_edit_profile_url_filter() {
+                remove_filter( 'bp_members_edit_profile_url', array( $this, 'filter_adminbar_profile_link' ), 10, 3 );
+        }
+
         /** Signups Management ***********************************************/
 
         /**