Ticket #7176: 7176.01.patch

src/bp-activity/bp-activity-admin.php

@@ -35 +35 @@
         $hook = add_menu_page(
                 _x( 'Activity', 'Admin Dashbord SWA page title', 'buddypress' ),
                 _x( 'Activity', 'Admin Dashbord SWA menu', 'buddypress' ),
-                'bp_moderate',
+                'manage_bp_activities',
                 'bp-activity',
                 'bp_activity_admin',
                 'div'
@@ -96 +96 @@
         if ( empty( $parent_activity->component ) )
                 die( __( 'ERROR: The item you are trying to reply to cannot be found, or it has been deleted.', 'buddypress' ) );
 
-        // @todo: Check if user is allowed to create new activity items
-        // if ( ! current_user_can( 'bp_new_activity' ) )
-        if ( ! current_user_can( 'bp_moderate' ) )
+        if ( ! bp_current_user_can( 'manage_bp_activities' ) )
                 die( '-1' );
 
         // Add new activity comment.
@@ -368 +366 @@
 
                 // "We'd like to shoot the monster, could you move, please?"
                 foreach ( $activity_ids as $activity_id ) {
-                        // @todo: Check the permissions on each
-                        // if ( ! current_user_can( 'bp_edit_activity', $activity_id ) )
-                        // continue;
+                        if ( ! bp_current_user_can( 'edit_bp_activity', array( 'object_id' => $activity_id ) ) ) {
+                                continue;
+                        }
+
                         // Get the activity from the database.
                         $activity = new BP_Activity_Activity( $activity_id );
                         if ( empty( $activity->component ) ) {
@@ -380 +379 @@
 
                         switch ( $doaction ) {
                                 case 'delete' :
-                                        if ( 'activity_comment' == $activity->type )
-                                                bp_activity_delete_comment( $activity->item_id, $activity->id );
-                                        else
-                                                bp_activity_delete( array( 'id' => $activity->id ) );
+                                        if ( bp_current_user_can( 'delete_bp_activity', array( 'object_id' => $activity->id ) ) ) {
+                                                if ( 'activity_comment' == $activity->type ) {
+                                                        bp_activity_delete_comment( $activity->item_id, $activity->id );
+                                                } else {
+                                                        bp_activity_delete( array( 'id' => $activity->id ) );
+                                                }
+
+                                                $deleted++;
+                                        }
 
-                                        $deleted++;
                                         break;
 
                                 case 'ham' :
@@ -477 +480 @@
                 // Get the activity from the database.
                 $activity = new BP_Activity_Activity( $activity_id );
 
-                // If the activity doesn't exist, just redirect back to the index.
-                if ( empty( $activity->component ) ) {
+                // If the activity doesn't exist or user doesn't have permission, just redirect back to the index.
+                if ( empty( $activity->component ) || ! bp_current_user_can( 'edit_bp_activity', array( 'object_id' => $activity->id ) ) ) {
                         wp_redirect( $redirect_to );
                         exit;
                 }
@@ -611 +614 @@
         $doaction = ! empty( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
 
         // Display the single activity edit screen.
-        if ( 'edit' == $doaction && ! empty( $_GET['aid'] ) )
+        if ( 'edit' == $doaction && ! empty( $_GET['aid'] ) && bp_current_user_can( 'edit_bp_activity', array( 'object_id' => $_GET['aid'] ) ) )
                 bp_activity_admin_edit();
 
         // Otherwise, display the Activity index screen.
@@ -625 +628 @@
  * @since 1.6.0
  */
 function bp_activity_admin_edit() {
+        $activity_id = ! empty( $_REQUEST['aid'] ) ? (int) $_REQUEST['aid'] : 0;
 
-        // @todo: Check if user is allowed to edit activity items
-        // if ( ! current_user_can( 'bp_edit_activity' ) )
-        if ( ! is_super_admin() )
+        if ( ! bp_current_user_can( 'edit_bp_activity', array( 'object_id' => $activity_id ) ) ) {
                 die( '-1' );
+        }
 
         // Get the activity from the database.
         $activity = bp_activity_get( array(
-                'in'               => ! empty( $_REQUEST['aid'] ) ? (int) $_REQUEST['aid'] : 0,
+                'in'               => $activity_id,
                 'max'              => 1,
                 'show_hidden'      => true,
                 'spam'             => 'all',

src/bp-activity/bp-activity-adminbar.php

@@ -26 +26 @@
                 return;
         }
 
-        // Only show this menu to super admins
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'manage_bp_activities' ) ) {
                 return;
         }
 

new file src/bp-activity/bp-activity-caps.php

@@ +1 @@
+<?php
+/**
+ * Roles and capabilities logic for the Activity component.
+ *
+ * @package BuddyPress
+ * @subpackage ActivityCaps
+ * @since 2.7.0
+ */
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Return an array of capabilities based on the role that is being requested.
+ *
+ * @since 2.7.0
+ *
+ * @param array  $caps Array of capabilities.
+ * @param string $role      The role currently being loaded.
+ * @return array            Capabilities for $role.
+ */
+function bp_activity_get_caps_for_role( $caps, $role ) {
+        $activity_caps = array();
+
+        switch ( $role ) {
+                case 'administrator' :
+                        $activity_caps = array(
+                                'manage_bp_activities' => true,  // wp-admin
+                                'edit_bp_activity'     => true,
+                                'edit_bp_activities'   => true,
+                                'create_bp_activities' => true,
+                                'delete_bp_activity'   => true,
+                                'delete_bp_activities' => true,
+                        );
+                        break;
+
+                // Any other role.
+                default :
+                        $activity_caps = array(
+                                'manage_bp_activities' => false,  // wp-admin
+                                'edit_bp_activity'     => true,
+                                'edit_bp_activities'   => false,
+                                'create_bp_activities' => true,
+                                'delete_bp_activity'   => true,
+                                'delete_bp_activities' => false,
+                        );
+                        break;
+        }
+
+        return array_merge( $caps, $activity_caps );
+}
+
+/**
+ * Maps Activity capabilities to built-in WordPress capabilities.
+ *
+ * @since 2.7.0
+ *
+ * @param array  $caps    Capabilities for meta capability.
+ * @param string $cap     Capability name.
+ * @param int    $user_id User id.
+ * @param mixed  $args    Arguments.
+ * @return array Actual capabilities for meta capability.
+ */
+function bp_activity_map_meta_caps( $caps, $cap, $user_id, $args ) {
+        $activity       = null;
+        $user_is_active = bp_is_user_active( $user_id );
+
+        if ( ! empty( $args[0]['object_id'] ) ) {
+                $activity = bp_activity_get( array(
+                        'in'               => absint( $args[0]['object_id'] ),
+                        'show_hidden'      => true,
+                        'spam'             => 'all',
+                        'display_comments' => 'stream'
+                ) );
+
+                $activity = empty( $activity['activities'] ) ? null : $activity['activities'][0];
+        }
+
+        switch ( $cap ) {
+                case 'edit_bp_activity' :
+                        if ( $activity && $user_id === $activity->user_id || bp_user_can( $user_id, 'edit_bp_activities' ) ) {
+                                $caps = array( $cap );
+                        } else {
+                                $caps = array( 'do_not_allow' );
+                        }
+                break;
+
+                case 'delete_bp_activities' :
+                case 'edit_bp_activities' :
+                case 'manage_bp_activities' :
+                        // This might change in the future when bp_moderate is less powerful.
+                        if ( bp_is_network_activated() && bp_user_can( $user_id, 'manage_network_options' ) ) {
+                                $caps = array( $cap );
+                        } elseif ( ! bp_is_network_activated() && bp_user_can( $user_id, 'manage_options' ) ) {
+                                $caps = array( $cap );
+                        } else {
+                                $caps = array( 'do_not_allow' );
+                        }
+                break;
+
+                case 'create_bp_activities' :
+                        $caps = array( $cap );
+                break;
+
+                case 'delete_bp_activity' :
+                        if ( $activity && $user_id === $activity->user_id || bp_user_can( $user_id, 'delete_bp_activities' ) ) {
+                                $caps = array( $cap );
+                        } else {
+                                $caps = array( 'do_not_allow' );
+                        }
+                break;
+
+                // Don't process any other capabilities further.
+                default :
+                        return $caps;
+                break;
+        }
+
+        if ( ! $user_is_active ) {
+                $caps = array( 'do_not_allow' );
+        }
+
+        /**
+         * Filter Activity capabilities.
+         *
+         * @since 2.7.0
+         *
+         * @param array  $caps    Capabilities for meta capability.
+         * @param string $cap     Capability name.
+         * @param int    $user_id User ID being mapped.
+         * @param mixed  $args    Capability arguments.
+         */
+        return apply_filters( 'bp_activity_map_meta_caps', $caps, $cap, $user_id, $args );
+}
+add_filter( 'bp_map_meta_caps', 'bp_activity_map_meta_caps', 10, 4 );

src/bp-activity/bp-activity-filters.php

@@ -111 +111 @@
 
 add_filter( 'bp_activity_get_embed_excerpt', 'bp_activity_embed_excerpt_onclick_location_filter', 9 );
 
+add_filter( 'bp_get_caps_for_role', 'bp_activity_get_caps_for_role', 10, 2 );
+
 /* Actions *******************************************************************/
 
 // At-name filter.

src/bp-activity/bp-activity-functions.php

@@ -3318 +3318 @@
          *
          * @param bool $moderate Whether or not the current user has bp_moderate capability.
          */
-        return apply_filters( 'bp_activity_user_can_mark_spam', bp_current_user_can( 'bp_moderate' ) );
+        return apply_filters( 'bp_activity_user_can_mark_spam', bp_current_user_can( 'edit_bp_activities' ) );
 }
 
 /**

src/bp-activity/bp-activity-screens.php

@@ -82 +82 @@
         if ( !bp_is_active( 'friends' ) )
                 return false;
 
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'edit_bp_activities' ), 'activity' );
 
         /**
          * Fires right before the loading of the "My Friends" screen template file.
@@ -111 +111 @@
         if ( !bp_is_active( 'groups' ) )
                 return false;
 
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'edit_bp_activities' ), 'activity' );
 
         /**
          * Fires right before the loading of the "My Groups" screen template file.
@@ -137 +137 @@
  *
  */
 function bp_activity_screen_favorites() {
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'edit_bp_activities' ), 'activity' );
 
         /**
          * Fires right before the loading of the "Favorites" screen template file.
@@ -163 +163 @@
  *
  */
 function bp_activity_screen_mentions() {
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'edit_bp_activities' ), 'activity' );
 
         /**
          * Fires right before the loading of the "Mentions" screen template file.

src/bp-activity/bp-activity-template.php

@@ -220 +220 @@
         if ( bp_is_group() ) {
                 $object      = $bp->groups->id;
                 $primary_id  = bp_get_current_group_id();
-                $show_hidden = (bool) ( groups_is_user_member( bp_loggedin_user_id(), $primary_id ) || bp_current_user_can( 'bp_moderate' ) );
+                $show_hidden = (bool) ( groups_is_user_member( bp_loggedin_user_id(), $primary_id ) || bp_current_user_can( 'edit_bp_activities' ) );
         } else {
                 $object      = false;
                 $primary_id  = false;
@@ -1553 +1553 @@
         $can_delete = false;
 
         // Only logged in users can delete activity.
-        if ( is_user_logged_in() ) {
-
-                // Community moderators can always delete activity (at least for now).
-                if ( bp_current_user_can( 'bp_moderate' ) ) {
-                        $can_delete = true;
-                }
-
-                // Users are allowed to delete their own activity. This is actually
-                // quite powerful, because doing so also deletes all comments to that
-                // activity item. We should revisit this eventually.
-                if ( isset( $activity->user_id ) && ( $activity->user_id === bp_loggedin_user_id() ) ) {
-                        $can_delete = true;
-                }
-
-                // Viewing a single item, and this user is an admin of that item.
-                if ( bp_is_single_item() && bp_is_item_admin() ) {
-                        $can_delete = true;
-                }
+        if ( is_user_logged_in() && bp_current_user_can( 'delete_bp_activity', array( 'object_id' => $activity->id ) ) ) {
+                $can_delete = true;
         }
 
         /**

src/bp-activity/classes/class-bp-activity-component.php

@@ -53 +53 @@
                         'cssjs',
                         'actions',
                         'screens',
+                        'caps',
                         'filters',
                         'adminbar',
                         'template',

src/bp-blogs/bp-blogs-activity.php

@@ -889 +889 @@
         switch_to_blog( $parent_activity->item_id );
 
         // Remove associated blog comments.
-        bp_blogs_remove_associated_blog_comments( $activity_ids, current_user_can( 'moderate_comments' ) );
+        bp_blogs_remove_associated_blog_comments( $activity_ids, bp_current_user_can( 'moderate_comments' ) );
 
         // Multisite again!
         restore_current_blog();

src/bp-core/admin/bp-core-admin-functions.php

@@ -829 +829 @@
         }
 
         // If user can't access BP Tools, there's no point showing the message.
-        if ( ! current_user_can( buddypress()->admin->capability ) ) {
+        if ( ! bp_current_user_can( buddypress()->admin->capability ) ) {
                 return;
         }
 
@@ -993 +993 @@
         }
 
         // Bail early if user cannot perform this action, or is looking at themselves.
-        if ( current_user_can( 'edit_user', $user_id ) && ( bp_loggedin_user_id() !== $user_id ) ) {
+        if ( bp_current_user_can( 'edit_user', $user_id ) && ( bp_loggedin_user_id() !== $user_id ) ) {
 
                 // Admin URL could be single site or network.
                 $url = bp_get_admin_url( 'users.php' );

src/bp-core/bp-core-actions.php

@@ -97 +97 @@
 add_action( 'bp_template_redirect', 'bp_post_request',       10 );
 add_action( 'bp_template_redirect', 'bp_get_request',        10 );
 
-/**
- * Add the BuddyPress functions file and the Theme Compat Default features.
- */
+// Add the BuddyPress functions file and the Theme Compat Default features.
 add_action( 'bp_after_setup_theme', 'bp_load_theme_functions',                    1 );
 add_action( 'bp_after_setup_theme', 'bp_register_theme_compat_default_features', 10 );
 
+// User capabilities.
+add_action( 'bp_new_site',     'bp_add_caps',    2 );
+add_action( 'bp_activation',   'bp_add_caps',    2 );
+add_action( 'bp_deactivation', 'bp_remove_caps', 1 );
+
 // Load the admin.
 if ( is_admin() ) {
         add_action( 'bp_loaded', 'bp_admin' );

src/bp-core/bp-core-caps.php

@@ -60 +60 @@
 function bp_add_caps() {
         global $wp_roles;
 
-        // Load roles if not set.
-        if ( ! isset( $wp_roles ) ) {
-                $wp_roles = new WP_Roles();
-        }
-
-        // Loop through available roles and add them.
         foreach( $wp_roles->role_objects as $role ) {
-                foreach ( bp_get_caps_for_role( $role->name ) as $cap ) {
-                        $role->add_cap( $cap );
+                foreach ( bp_get_caps_for_role( $role->name ) as $cap => $value ) {
+                        $role->add_cap( $cap, $value );
                 }
         }
 
@@ -92 +86 @@
 function bp_remove_caps() {
         global $wp_roles;
 
-        // Load roles if not set.
-        if ( ! isset( $wp_roles ) ) {
-                $wp_roles = new WP_Roles();
-        }
-
-        // Loop through available roles and remove them.
         foreach( $wp_roles->role_objects as $role ) {
-                foreach ( bp_get_caps_for_role( $role->name ) as $cap ) {
+                foreach ( array_keys( bp_get_caps_for_role( $role->name ) ) as $cap ) {
                         $role->remove_cap( $cap );
                 }
         }
@@ -119 +107 @@
  *
  * @since 1.6.0
  *
- * @see WP_User::has_cap() for description of the arguments passed to the
- *      'map_meta_cap' filter.
- *       args.
- *
- * @param array  $caps    See {@link WP_User::has_cap()}.
- * @param string $cap     See {@link WP_User::has_cap()}.
- * @param int    $user_id See {@link WP_User::has_cap()}.
- * @param mixed  $args    See {@link WP_User::has_cap()}.
- * @return array Actual capabilities for meta capability. See {@link WP_User::has_cap()}.
+ * @param array  $caps    The user's actual capabilities.
+ * @param string $cap     Capability name.
+ * @param int    $user_id The user ID.
+ * @param array  $args    Adds the context to the cap. Typically the object ID.
+ * @return array          Actual capabilities for meta capability.
  */
 function bp_map_meta_caps( $caps, $cap, $user_id, $args ) {
 
@@ -145 +129 @@
 }
 
 /**
- * Return community capabilities.
- *
- * @since 1.6.0
- *
- * @return array Community capabilities.
- */
-function bp_get_community_caps() {
-
-        // Forum meta caps.
-        $caps = array();
-
-        /**
-         * Filters community capabilities.
-         *
-         * @since 1.6.0
-         *
-         * @param array $caps Array of capabilities to add. Empty by default.
-         */
-        return apply_filters( 'bp_get_community_caps', $caps );
-}
-
-/**
  * Return an array of capabilities based on the role that is being requested.
  *
  * @since 1.6.0
+ * @since 2.7.0 $role parameter made mandatory.
  *
  * @param string $role The role for which you're loading caps.
  * @return array Capabilities for $role.
  */
-function bp_get_caps_for_role( $role = '' ) {
+function bp_get_caps_for_role( $role ) {
+        $caps = array();
 
-        // Which role are we looking for?
         switch ( $role ) {
-
-                // Administrator.
                 case 'administrator' :
                         $caps = array(
-                                // Misc.
-                                'bp_moderate',
+                                'bp_moderate' => true,
                         );
-
                         break;
 
-                // All other default WordPress blog roles.
-                case 'editor'      :
-                case 'author'      :
-                case 'contributor' :
-                case 'subscriber'  :
-                default            :
-                        $caps = array();
+                // Every other role.
+                default :
+                        $caps = array(
+                                'bp_moderate' => false,
+                        );
                         break;
         }
 
@@ -203 +160 @@
          *
          * @since 1.6.0
          *
-         * @param array  $caps Array of capabilities to return.
+         * @param array  $caps Array of capabilities.
          * @param string $role The role currently being loaded.
          */
         return apply_filters( 'bp_get_caps_for_role', $caps, $role );

src/bp-core/bp-core-filters.php

@@ -322 +322 @@
         // If a 'redirect_to' parameter has been passed that contains 'wp-admin', verify that the
         // logged-in user has any business to conduct in the Dashboard before allowing the
         // redirect to go through.
-        if ( !empty( $redirect_to ) && ( false === strpos( $redirect_to, 'wp-admin' ) || user_can( $user, 'edit_posts' ) ) ) {
+        if ( !empty( $redirect_to ) && ( false === strpos( $redirect_to, 'wp-admin' ) || bp_user_can( $user, 'edit_posts' ) ) ) {
                 return $redirect_to;
         }
 

src/bp-core/bp-core-update.php

@@ -263 +263 @@
                 if ( $raw_db_version < 10440 ) {
                         bp_update_to_2_5();
                 }
+
+                // Version 2.7.0.
+                if ( $raw_db_version < 10940 ) {
+                        bp_update_to_2_7();
+                }
         }
 
         /* All done! *************************************************************/
@@ -500 +505 @@
 }
 
 /**
+ * 2.5.0 update routine.
+ *
+ * - Add capabilities for Activity component.
+ *
+ * @since 2.7.0
+ */
+function bp_update_to_2_7() {
+        bp_add_caps();
+
+
+        // Multisite-only beyond this point.
+        if ( ! bp_is_network_activated() ) {
+                return;
+        }
+
+        // WP 4.6+
+        if ( function_exists( 'get_sites' ) ) {
+                $sites = get_sites( array( 'fields' => 'ids' ) );
+
+        } else {
+                if ( wp_is_large_network() ) {
+                        $sites = array();
+                } else {
+                        $sites = wp_list_pluck( wp_get_sites(), 'blog_id' );
+                }
+        }
+
+        $original_site_id = get_current_blog_id();
+        foreach ( $sites as $site_id ) {
+                switch_to_blog( $site_id );
+                bp_add_caps();
+                restore_current_blog();
+        }
+
+        if ( get_current_blog_id() !== $original_site_id ) {
+                switch_to_blog( $original_site_id );
+        }
+}
+
+/**
  * Updates the component field for new_members type.
  *
  * @since 2.2.0

src/bp-core/classes/class-bp-embed.php

@@ -122 +122 @@
                  */
                 $id = apply_filters( 'embed_post_id', 0 );
 
-                $unfiltered_html   = current_user_can( 'unfiltered_html' );
+                $unfiltered_html   = bp_current_user_can( 'unfiltered_html' );
                 $default_discovery = false;
 
                 // Since 4.4, WordPress is now an oEmbed provider.

src/bp-core/deprecated/2.1.php

@@ -261 +261 @@
 }
 
 function bp_adminbar_thisblog_menu() {
-        if ( current_user_can( 'edit_posts' ) ) {
+        if ( bp_current_user_can( 'edit_posts' ) ) {
                 echo '<li id="bp-adminbar-thisblog-menu"><a href="' . admin_url() . '">';
                 _e( 'Dashboard', 'buddypress' );
                 echo '</a>';

src/bp-core/deprecated/2.7.php

@@ -24 +24 @@
         require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
         return !empty( $wpdb->charset ) ? "DEFAULT CHARACTER SET {$wpdb->charset}" : '';
 }
+
+/**
+ * Return community capabilities.
+ *
+ * @since 1.6.0
+ * @deprecated 2.7.0
+ *
+ * @return array Community capabilities.
+ */
+function bp_get_community_caps() {
+        _deprecated_function( __FUNCTION__, '2.7' );
+
+        // Forum meta caps.
+        $caps = array();
+
+        /**
+         * Filters community capabilities.
+         *
+         * @since 1.6.0
+         *
+         * @param array $caps Array of capabilities to add. Empty by default.
+         */
+        return apply_filters( 'bp_get_community_caps', $caps );
+}

src/bp-groups/bp-groups-admin.php

@@ -502 +502 @@
  */
 function bp_groups_admin_edit() {
 
-        if ( ! current_user_can( 'bp_moderate' ) )
+        if ( ! bp_current_user_can( 'bp_moderate' ) )
                 die( '-1' );
 
         $messages = array();
@@ -1083 +1083 @@
         check_admin_referer( 'bp-group-type-change-' . $group_id, 'bp-group-type-nonce' );
 
         // Permission check.
-        if ( ! current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
                 return;
         }
 
@@ -1194 +1194 @@
 function bp_groups_admin_autocomplete_handler() {
 
         // Bail if user user shouldn't be here, or is a large network.
-        if ( ! current_user_can( 'bp_moderate' ) || ( is_multisite() && wp_is_large_network( 'users' ) ) ) {
+        if ( ! bp_current_user_can( 'bp_moderate' ) || ( is_multisite() && wp_is_large_network( 'users' ) ) ) {
                 wp_die( -1 );
         }
 

src/bp-groups/bp-groups-filters.php

@@ -310 +310 @@
  */
 function bp_groups_disable_at_mention_notification_for_non_public_groups( $send, $usernames, $user_id, BP_Activity_Activity $activity ) {
         // Skip the check for administrators, who can get notifications from non-public groups.
-        if ( user_can( $user_id, 'bp_moderate' ) ) {
+        if ( bp_user_can( $user_id, 'bp_moderate' ) ) {
                 return $send;
         }
 

src/bp-groups/bp-groups-template.php

@@ -2093 +2093 @@
 
         if ( $user_id ) {
                 // Users with the 'bp_moderate' cap can always send invitations.
-                if ( user_can( $user_id, 'bp_moderate' ) ) {
+                if ( bp_user_can( $user_id, 'bp_moderate' ) ) {
                         $can_send_invites = true;
                 } else {
                         $invite_status = bp_group_get_invite_status( $group_id );

src/bp-groups/classes/class-bp-group-extension.php

@@ -810 +810 @@
          * @return bool
          */
         public function user_can_see_nav_item( $user_can_see_nav_item = false ) {
-                if ( 'noone' !== $this->params['show_tab'] && current_user_can( 'bp_moderate' ) ) {
+                if ( 'noone' !== $this->params['show_tab'] && bp_current_user_can( 'bp_moderate' ) ) {
                         return true;
                 }
 
@@ -826 +826 @@
          * @return bool
          */
         public function user_can_visit( $user_can_visit = false ) {
-                if ( 'noone' !== $this->params['access'] && current_user_can( 'bp_moderate' ) ) {
+                if ( 'noone' !== $this->params['access'] && bp_current_user_can( 'bp_moderate' ) ) {
                         return true;
                 }
 

src/bp-groups/classes/class-bp-groups-group.php

@@ -1455 +1455 @@
          * Get a total group count for the site.
          *
          * Will include hidden groups in the count only if
-         * current_user_can( 'bp_moderate' ).
+         * bp_current_user_can( 'bp_moderate' ).
          *
          * @since 1.6.0
          *

src/bp-loader.php

@@ -331 +331 @@
                 /** Versions **********************************************************/
 
                 $this->version    = '2.7-alpha';
-                $this->db_version = 10469;
+                $this->db_version = 10940;
 
                 /** Loading ***********************************************************/
 

src/bp-members/bp-members-functions.php

@@ -1482 +1482 @@
                 return false;
         }
 
-        if ( bp_current_user_can( 'bp_moderate' ) || current_user_can( 'edit_users' ) ) {
+        if ( bp_current_user_can( 'bp_moderate' ) || bp_current_user_can( 'edit_users' ) ) {
                 return true;
         }
 

src/bp-members/classes/class-bp-members-admin.php

@@ -200 +200 @@
                         }
 
                         // Reorganise the views navigation in users.php and signups page.
-                        if ( current_user_can( $this->capability ) ) {
+                        if ( bp_current_user_can( $this->capability ) ) {
                                 $user_screen = $this->users_screen;
 
                                 /**
@@ -644 +644 @@
                          * admins do not have the capacity to edit other users, we must add
                          * this check.
                          */
-                        if ( current_user_can( 'edit_user', $user->ID ) ) : ?>
+                        if ( bp_current_user_can( 'edit_user', $user->ID ) ) : ?>
 
                                 <a class="nav-tab<?php echo esc_attr( $wp_active ); ?>" href="<?php echo esc_url( $wordpress_url );?>"><?php _e( 'Profile', 'buddypress' ); ?></a>
 
@@ -889 +889 @@
 
                                 <?php if ( empty( $this->is_self_profile ) ) : ?>
 
-                                        <?php if ( current_user_can( 'create_users' ) ) : ?>
+                                        <?php if ( bp_current_user_can( 'create_users' ) ) : ?>
 
                                                 <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add New', 'user', 'buddypress' ); ?></a>
 
-                                        <?php elseif ( is_multisite() && current_user_can( 'promote_users' ) ) : ?>
+                                        <?php elseif ( is_multisite() && bp_current_user_can( 'promote_users' ) ) : ?>
 
                                                 <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add Existing', 'user', 'buddypress' ); ?></a>
 
@@ -989 +989 @@
                                          * Also prevent admins from marking themselves or other
                                          * admins as spammers.
                                          */
-                                        if ( ( empty( $this->is_self_profile ) && ( ! in_array( $user->user_login, get_super_admins() ) ) && empty( $this->subsite_activated ) ) || ( ! empty( $this->subsite_activated ) && current_user_can( 'manage_network_users' ) ) ) : ?>
+                                        if ( ( empty( $this->is_self_profile ) && ( ! in_array( $user->user_login, get_super_admins() ) ) && empty( $this->subsite_activated ) ) || ( ! empty( $this->subsite_activated ) && bp_current_user_can( 'manage_network_users' ) ) ) : ?>
 
                                                 <div class="misc-pub-section" id="comment-status-radio">
                                                         <label class="approved"><input type="radio" name="user_status" value="ham" <?php checked( $is_spammer, false ); ?>><?php esc_html_e( 'Active', 'buddypress' ); ?></label><br />
@@ -1140 +1140 @@
                 check_admin_referer( 'bp-member-type-change-' . $user_id, 'bp-member-type-nonce' );
 
                 // Permission check.
-                if ( ! current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {
+                if ( ! bp_current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {
                         return;
                 }
 
@@ -1187 +1187 @@
                 $args['wp_http_referer'] = urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) );
 
                 // Add the "Extended" link if the current user can edit this user.
-                if ( current_user_can( 'edit_user', $user->ID ) || bp_current_user_can( 'bp_moderate' ) ) {
+                if ( bp_current_user_can( 'edit_user', $user->ID ) || bp_current_user_can( 'bp_moderate' ) ) {
 
                         // Add query args and setup the Extended link.
                         $edit_profile      = add_query_arg( $args, $this->edit_profile_url );
@@ -1867 +1867 @@
                 <div class="wrap">
                         <h1><?php _e( 'Users', 'buddypress' ); ?>
 
-                                <?php if ( current_user_can( 'create_users' ) ) : ?>
+                                <?php if ( bp_current_user_can( 'create_users' ) ) : ?>
 
                                         <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add New', 'user', 'buddypress' ); ?></a>
 
-                                <?php elseif ( is_multisite() && current_user_can( 'promote_users' ) ) : ?>
+                                <?php elseif ( is_multisite() && bp_current_user_can( 'promote_users' ) ) : ?>
 
                                         <a href="user-new.php" class="add-new-h2"><?php echo esc_html_x( 'Add Existing', 'user', 'buddypress' ); ?></a>
 
@@ -1908 +1908 @@
          * @return string
          */
         public function signups_admin_manage( $action = '' ) {
-                if ( ! current_user_can( $this->capability ) || empty( $action ) ) {
+                if ( ! bp_current_user_can( $this->capability ) || empty( $action ) ) {
                         die( '-1' );
                 }
 

src/bp-members/classes/class-bp-members-list-table.php

@@ -167 +167 @@
                         'resend'   => _x( 'Email',    'Pending signup action', 'buddypress' ),
                 );
 
-                if ( current_user_can( 'delete_users' ) ) {
+                if ( bp_current_user_can( 'delete_users' ) ) {
                         $actions['delete'] = __( 'Delete', 'buddypress' );
                 }
 
@@ -189 +189 @@
                         $link = false;
 
                         // Specific case when BuddyPress is not network activated.
-                        if ( is_multisite() && current_user_can( 'manage_network_users') ) {
+                        if ( is_multisite() && bp_current_user_can( 'manage_network_users') ) {
                                 $link = sprintf( '<a href="%1$s">%2$s</a>', esc_url( network_admin_url( 'settings.php'       ) ), esc_html__( 'Edit settings', 'buddypress' ) );
-                        } elseif ( current_user_can( 'manage_options' ) ) {
+                        } elseif ( bp_current_user_can( 'manage_options' ) ) {
                                 $link = sprintf( '<a href="%1$s">%2$s</a>', esc_url( bp_get_admin_url( 'options-general.php' ) ), esc_html__( 'Edit settings', 'buddypress' ) );
                         }
 
@@ -315 +315 @@
                 $actions['activate'] = sprintf( '<a href="%1$s">%2$s</a>', esc_url( $activate_link ), __( 'Activate', 'buddypress' ) );
                 $actions['resend']   = sprintf( '<a href="%1$s">%2$s</a>', esc_url( $email_link ), __( 'Email', 'buddypress' ) );
 
-                if ( current_user_can( 'delete_users' ) ) {
+                if ( bp_current_user_can( 'delete_users' ) ) {
                         $actions['delete'] = sprintf( '<a href="%1$s" class="delete">%2$s</a>', esc_url( $delete_link ), __( 'Delete', 'buddypress' ) );
                 }
 

src/bp-members/classes/class-bp-members-ms-list-table.php

@@ -154 +154 @@
                         'resend'   => _x( 'Email',    'Pending signup action', 'buddypress' ),
                 );
 
-                if ( current_user_can( 'delete_users' ) ) {
+                if ( bp_current_user_can( 'delete_users' ) ) {
                         $actions['delete'] = __( 'Delete', 'buddypress' );
                 }
 
@@ -174 +174 @@
                 } else {
                         $link = false;
 
-                        if ( current_user_can( 'manage_network_users' ) ) {
+                        if ( bp_current_user_can( 'manage_network_users' ) ) {
                                 $link = sprintf( '<a href="%1$s">%2$s</a>', esc_url( network_admin_url( 'settings.php' ) ), esc_html__( 'Edit settings', 'buddypress' ) );
                         }
 
@@ -308 +308 @@
                 $actions['activate'] = sprintf( '<a href="%1$s">%2$s</a>', esc_url( $activate_link ), __( 'Activate', 'buddypress' ) );
                 $actions['resend']   = sprintf( '<a href="%1$s">%2$s</a>', esc_url( $email_link    ), __( 'Email',    'buddypress' ) );
 
-                if ( current_user_can( 'delete_users' ) ) {
+                if ( bp_current_user_can( 'delete_users' ) ) {
                         $actions['delete'] = sprintf( '<a href="%1$s" class="delete">%2$s</a>', esc_url( $delete_link ), __( 'Delete', 'buddypress' ) );
                 }
 

src/bp-templates/bp-legacy/buddypress/activity/index.php

@@ -26 +26 @@
          */
         do_action( 'bp_before_directory_activity_content' ); ?>
 
-        <?php if ( is_user_logged_in() ) : ?>
+        <?php if ( is_user_logged_in() && bp_current_user_can( 'create_bp_activities' ) ) : ?>
 
                 <?php bp_get_template_part( 'activity/post-form' ); ?>
 

src/bp-xprofile/bp-xprofile-functions.php

@@ -1172 +1172 @@
                 $current_user_id = bp_loggedin_user_id();
         }
 
-        // @todo - This is where you'd swap out for current_user_can() checks
+        // @todo - This is where you'd swap out for bp_current_user_can() checks
         $hidden_levels = bp_xprofile_get_hidden_field_types_for_user( $displayed_user_id, $current_user_id );
         $hidden_fields = bp_xprofile_get_fields_by_visibility_levels( $displayed_user_id, $hidden_levels );