Ticket #7048: 7048-3.diff

src/bp-activity/bp-activity-functions.php

@@ -3077 +3077 @@
         return apply_filters_ref_array( 'bp_activity_get_permalink', array( $link, &$activity_obj ) );
 }
 
+/**
+ * Can a user see a particular activity item?
+ *
+ * @since 3.0.0
+ *
+ * @param  BP_Activity_Activity $activity Activity object.
+ * @param  integer              $user_id  User ID.
+ * @return boolean True on success, false on failure.
+ */
+function bp_activity_user_can_read( $activity, $user_id = 0 ) {
+        $bp     = buddypress();
+        $retval = false;
+
+        // Fallback.
+        if ( empty( $user_id ) ) {
+                $user_id = bp_loggedin_user_id();
+        }
+
+        // Admins and moderators can see everything.
+        if ( bp_current_user_can( 'bp_moderate' ) ) {
+                $retval = true;
+        }
+
+        // If activity author match user, allow access as well.
+        if ( $user_id === $activity->user_id ) {
+                $retval = true;
+        }
+
+        // If activity is from a group, do an extra cap check.
+        if ( ! $retval && bp_is_active( 'groups' ) && $activity->component === $bp->groups->id ) {
+                $group_id = $activity->item_id;
+
+                // Check to see if the user has access to the activity's parent group.
+                $group = groups_get_group( $group_id );
+                if ( $group ) {
+                        $retval = $group->user_has_access;
+                }
+
+                // Group admins and mods have access as well.
+                if ( groups_is_user_admin( $user_id, $group_id ) || groups_is_user_mod( $user_id, $group_id ) ) {
+                        $retval = true;
+                }
+        }
+
+        /**
+         * Filters whether the current user has access to an activity item.
+         *
+         * @since 3.0.0
+         *
+         * @param bool                 $retval   Return value.
+         * @param int                  $user_id  Current user ID.
+         * @param BP_Activity_Activity $activity Activity object.
+         */
+        return apply_filters( 'bp_activity_permalink_access', $retval, $user_id, $activity );
+}
+
 /**
  * Hide a user's activity.
  *

src/bp-activity/bp-activity-screens.php

@@ -195 +195 @@
  *
  * @since 1.2.0
  *
+ * @return bool|string Boolean on false or the template for a single activity item on success.
  */
 function bp_activity_screen_single_activity_permalink() {
-        $bp = buddypress();
-
         // No displayed user or not viewing activity component.
-        if ( !bp_is_activity_component() )
+        if ( ! bp_is_activity_component() ) {
                 return false;
+        }
 
-        if ( ! bp_current_action() || !is_numeric( bp_current_action() ) )
+        $action = bp_current_action();
+        if ( ! $action || ! is_numeric( $action ) ) {
                 return false;
+        }
 
         // Get the activity details.
-        $activity = bp_activity_get_specific( array( 'activity_ids' => bp_current_action(), 'show_hidden' => true, 'spam' => 'ham_only', ) );
+        $activity = bp_activity_get_specific( array(
+                'activity_ids' => $action,
+                'show_hidden'  => true,
+                'spam'         => 'ham_only',
+        ) );
 
         // 404 if activity does not exist
         if ( empty( $activity['activities'][0] ) || bp_action_variables() ) {
@@ -218 +224 @@
                 $activity = $activity['activities'][0];
         }
 
-        // Default access is true.
-        $has_access = true;
-
-        // If activity is from a group, do an extra cap check.
-        if ( isset( $bp->groups->id ) && $activity->component == $bp->groups->id ) {
-
-                // Activity is from a group, but groups is currently disabled.
-                if ( !bp_is_active( 'groups') ) {
-                        bp_do_404();
-                        return;
-                }
-
-                // Check to see if the user has access to to the activity's parent group.
-                if ( $group = groups_get_group( $activity->item_id ) ) {
-                        $has_access = $group->user_has_access;
-                }
-        }
-
-        // If activity author does not match displayed user, block access.
-        if ( true === $has_access && bp_displayed_user_id() !== $activity->user_id ) {
-                $has_access = false;
-        }
-
         /**
-         * Filters the access permission for a single activity view.
+         * Check user access to the activity item.
          *
-         * @since 1.2.0
-         *
-         * @param array $access Array holding the current $has_access value and current activity item instance.
+         * @since 3.0.0
          */
-        $has_access = apply_filters_ref_array( 'bp_activity_permalink_access', array( $has_access, &$activity ) );
+        $has_access = bp_activity_user_can_read( $activity, bp_displayed_user_id() );
 
         /**
          * Fires before the loading of a single activity template file.
@@ -273 +254 @@
                 } else {
                         $url = sprintf(
                                 wp_login_url( 'wp-login.php?redirect_to=%s' ),
-                                esc_url_raw( bp_activity_get_permalink( bp_current_action() ) )
+                                esc_url_raw( bp_activity_get_permalink( $action ) )
                         );
                 }
 
@@ -287 +268 @@
          *
          * @param string $template Path to the activity template to load.
          */
-        bp_core_load_template( apply_filters( 'bp_activity_template_profile_activity_permalink', 'members/single/activity/permalink' ) );
+        $template = apply_filters( 'bp_activity_template_profile_activity_permalink', 'members/single/activity/permalink' );
+
+        // Load the template.
+        bp_core_load_template( $template );
 }
 add_action( 'bp_screens', 'bp_activity_screen_single_activity_permalink' );
 

src/bp-blogs/bp-blogs-activity.php

@@ -1148 +1148 @@
 
         $allow_comments = bp_blogs_comments_open( $activity );
         $thread_depth   = bp_blogs_get_blogmeta( $activity->item_id, 'thread_comments_depth' );
-        $moderation     = bp_blogs_get_blogmeta( $activity->item_id, 'comment_moderation' );
 
         // Initialize a local object so we won't have to query this again in the
         // comment loop.
@@ -1158 +1157 @@
         if ( empty( buddypress()->blogs->thread_depth ) ) {
                 buddypress()->blogs->thread_depth   = array();
         }
-        if ( empty( buddypress()->blogs->comment_moderation ) ) {
-                buddypress()->blogs->comment_moderation = array();
-        }
 
-        /*
-         * Cache comment settings in the buddypress() singleton for later reference.
-         *
-         * See bp_blogs_disable_activity_commenting() / bp_blogs_can_comment_reply().
-         *
-         * thread_depth is keyed by activity ID instead of blog ID because when we're
-         * in an actvity comment loop, we don't have access to the blog ID...
-         *
-         * Should probably object cache these values instead...
-         */
-        buddypress()->blogs->allow_comments[ $activity->id ]     = $allow_comments;
-        buddypress()->blogs->thread_depth[ $activity->id ]       = $thread_depth;
-        buddypress()->blogs->comment_moderation[ $activity->id ] = $moderation;
+        // Cache comment settings in the buddypress() singleton to reference later in
+        // the activity comment loop
+        // @see bp_blogs_disable_activity_replies()
+        //
+        // thread_depth is keyed by activity ID instead of blog ID because when we're
+        // in a comment loop, we don't have access to the blog ID...
+        // should probably object cache these values instead...
+        buddypress()->blogs->allow_comments[ $activity->id ] = $allow_comments;
+        buddypress()->blogs->thread_depth[ $activity->id ]   = $thread_depth;
 }
 
 /**
@@ -1239 +1231 @@
                         if ( empty( buddypress()->blogs->allow_comments[ bp_get_activity_id() ] ) ) {
                                 $retval = false;
                         }
-
-                        // If comments need moderation, disable activity commenting.
-                        if ( ! empty( buddypress()->blogs->comment_moderation[ bp_get_activity_id() ] ) ) {
-                                $retval = false;
-                        }
                 // The activity type does not support comments or replies
                 } else {
                         $retval = false;
@@ -1327 +1314 @@
                 }
         }
 
-        // If comments need moderation, disable activity commenting.
-        if ( ! empty( buddypress()->blogs->comment_moderation[$comment->item_id] ) ) {
-                $retval = false;
-        }
-
         return $retval;
 }
 add_filter( 'bp_activity_can_comment_reply', 'bp_blogs_can_comment_reply', 10, 2 );

src/bp-blogs/bp-blogs-functions.php

@@ -362 +362 @@
         $description     = get_blog_option( $blog_id, 'blogdescription' );
         $close_old_posts = get_blog_option( $blog_id, 'close_comments_for_old_posts' );
         $close_days_old  = get_blog_option( $blog_id, 'close_comments_days_old' );
-        $moderation      = get_blog_option( $blog_id, 'comment_moderation' );
 
         $thread_depth = get_blog_option( $blog_id, 'thread_comments' );
         if ( ! empty( $thread_depth ) ) {
@@ -385 +384 @@
         bp_blogs_update_blogmeta( $recorded_blog->blog_id, 'close_comments_for_old_posts', $close_old_posts );
         bp_blogs_update_blogmeta( $recorded_blog->blog_id, 'close_comments_days_old', $close_days_old );
         bp_blogs_update_blogmeta( $recorded_blog->blog_id, 'thread_comments_depth', $thread_depth );
-        bp_blogs_update_blogmeta( $recorded_blog->blog_id, 'comment_moderation', $moderation );
 
         $is_private = !empty( $_POST['blog_public'] ) && (int) $_POST['blog_public'] ? false : true;
 
@@ -527 +525 @@
 }
 add_action( 'update_option_thread_comments_depth', 'bp_blogs_update_option_thread_comments_depth', 10, 2 );
 
-/**
- * When updating comment moderation, mirror value in blogmeta table.
- *
- * @since 3.0.0
- *
- * @param string $oldvalue Value before save. Passed by do_action() but unused here.
- * @param string $newvalue Value to change meta to.
- */
-function bp_blogs_update_option_comment_moderation( $oldvalue, $newvalue ) {
-        bp_blogs_update_blogmeta( $GLOBALS['wpdb']->blogid, 'comment_moderation', $newvalue );
-}
-add_action( 'update_option_comment_moderation', 'bp_blogs_update_option_comment_moderation', 10, 2 );
-
 /**
  * Syncs site icon URLs to blogmeta.
  *

src/bp-templates/bp-legacy/buddypress/activity/index.php

@@ -91 +91 @@
 
                                         <?php if ( bp_get_total_group_count_for_user( bp_loggedin_user_id() ) ) : ?>
 
-                                                <?php
-                                                printf(
-                                                        '<li id="activity-groups"><a href="%1$s">%2$s</a></li>',
-                                                        esc_url( bp_loggedin_user_domain() . bp_get_activity_slug() . '/' . bp_get_groups_slug() . '/' ),
-                                                        sprintf(
-                                                                /* translators: %s: total joined groups count for the current user */
-                                                                __( 'My Groups %s', 'buddypress' ),
-                                                                '<span>' . bp_get_total_group_count_for_user( bp_loggedin_user_id() ) . '</span>'
-                                                        )
-                                                );
-                                                ?>
+                                                <li id="activity-groups"><a href="<?php echo bp_loggedin_user_domain() . bp_get_activity_slug() . '/' . bp_get_groups_slug() . '/'; ?>"><?php printf( __( 'My Groups %s', 'buddypress' ), '<span>' . bp_get_total_group_count_for_user( bp_loggedin_user_id() ) . '</span>' ); ?></a></li>
 
                                         <?php endif; ?>
 

tests/phpunit/testcases/activity/functions.php

@@ -1475 +1475 @@
                 $this->assertSame( array(), $found['activities'] );
         }
 
+        /**
+         * @group bp_activity_user_can_read
+         */
+        public function test_user_can_access_their_own_activity() {
+                $u = self::factory()->user->create();
+
+                $a = self::factory()->activity->create( array(
+                        'user_id' => $u,
+                ) );
+
+                $o = self::factory()->activity->get_object_by_id( $a );
+
+                $this->assertTrue( bp_activity_user_can_read( $o, $u ) );
+        }
+
+        /**
+         * @group bp_activity_user_can_read
+         */
+        public function test_user_cant_access_someone_elses_activity() {
+                $u = self::factory()->user->create();
+                $u2 = self::factory()->user->create();
+
+                $a = self::factory()->activity->create( array(
+                        'user_id' => $u2,
+                ) );
+
+                $o = self::factory()->activity->get_object_by_id( $a );
+
+                $this->assertFalse( bp_activity_user_can_read( $o, $u ) );
+        }
+
+        /**
+         * @group bp_activity_user_can_read
+         */
+        public function test_group_admin_access_to_someone_elses_activity() {
+                $u = self::factory()->user->create();
+
+                $g = self::factory()->group->create( array(
+                        'status' => 'public',
+                ) );
+
+                $a = self::factory()->activity->create( array(
+                        'component' => buddypress()->groups->id,
+                        'user_id'   => $u,
+                        'item_id'   => $g,
+                ) );
+
+                $o = self::factory()->activity->get_object_by_id( $a );
+
+                $c = self::factory()->user->create();
+                self::add_user_to_group( $c, $g );
+
+                $m1 = new BP_Groups_Member( $c, $g );
+                $m1->promote( 'admin' );
+
+                $this->assertTrue( bp_activity_user_can_read( $o, $c ) );
+        }
+
+        /**
+         * @group bp_activity_user_can_read
+         */
+        public function test_admin_access_to_someone_elses_activity() {
+                $u = self::factory()->user->create();
+                $u2 = self::factory()->user->create( array( 'role' => 'administrator' ) );
+
+                $a = self::factory()->activity->create( array(
+                        'user_id' => $u,
+                ) );
+
+                $o = self::factory()->activity->get_object_by_id( $a );
+
+                $this->set_current_user( $u2 );
+                $this->assertTrue( bp_activity_user_can_read( $o, $u2 ) );
+        }
+
         public function check_activity_caches() {
                 foreach ( $this->acaches as $k => $v ) {
                         $this->acaches[ $k ] = wp_cache_get( $k, 'bp_activity' );

tests/phpunit/testcases/core/class-bp-email.php

@@ -256 +256 @@
                 bp_core_install_emails();
 
                 $user1  = get_user_by( 'id', $this->u1 );
-                $result = bp_send_email( 'activity-comment', $this->u1, array(
+                $result = bp_send_email( 'core-user-registration', $this->u1, array(
                         'tokens' => array(
-                                'comment.id'                => 123,
-                                'commenter.id'              => $this->u2,
-                                'usermessage'               => 'hello world',
-                                'original_activity.user_id' => $this->u1,
-                                'poster.name'               => 'name',
-                                'thread.url'                => 'http://example.com',
-                                'unsubscribe'               => 'http://example.com',
+                                'activate.url' => 'http://example.com',
+                                'key'          => '123',
+                                'user.email'   => $user1->user_email,
+                                'user.id'      => $this->u1,
                         ),
                 ) );