Ticket #7826: 7826.05.patch

new file src/bp-settings/actions/data.php

@@ +1 @@
+<?php
+/**
+ * Settings: Data management action handler
+ *
+ * @package BuddyPress
+ * @subpackage SettingsActions
+ * @since 4.0.0
+ */
+
+/**
+ * Data export request handler.
+ *
+ * @since 4.0.0
+ */
+add_action( 'bp_actions', function() {
+        if ( ! bp_is_post_request() || ! bp_displayed_user_id() || empty( $_POST['bp-data-export-nonce'] ) ) {
+                return;
+        }
+
+        // Nonce check.
+        check_admin_referer( 'bp-data-export', 'bp-data-export-nonce' );
+
+        // Delete existing request if available.
+        if ( ! empty( $_POST['bp-data-export-delete-request-nonce'] ) && wp_verify_nonce( $_POST['bp-data-export-delete-request-nonce'], 'bp-data-export-delete-request' ) ) {
+                $existing = bp_settings_get_personal_data_request();
+                if ( ! empty( $existing->ID ) ) {
+                        wp_delete_post( $existing->ID, true );
+                }
+        }
+
+        // Create the user request.
+        $request_id = wp_create_user_request( buddypress()->displayed_user->userdata->user_email, 'export_personal_data' );
+
+        $success = true;
+        if ( is_wp_error( $request_id ) ) {
+                $success = false;
+                $message = $request_id->get_error_message();
+        } elseif ( ! $request_id ) {
+                $success = false;
+                $message = __( 'We were unable to generate the data export request.', 'buddypress' );
+        }
+
+        /*
+         * Auto-confirm the user request since the user already consented by
+         * submitting our form.
+         */
+        if ( $success ) {
+                /** This hook is documented in /wp-login.php */
+                do_action( 'user_request_action_confirmed', $request_id );
+
+                $message = __( 'Data export request successfully created', 'buddypress' );
+        }
+
+        /**
+         * Fires after a user has created a data export request.
+         *
+         * This hook can be used to intervene in the data export request process.
+         *
+         * @since 4.0.0
+         *
+         * @param int  $request_id ID of the request.
+         * @param bool $success    Whether the request was successfully created by WordPress.
+         */
+        do_action( 'bp_user_data_export_requested', $request_id, $success );
+
+        bp_core_add_message( $message, $success ? 'success' : 'error' );
+        bp_core_redirect( bp_get_requested_url() );
+} );

src/bp-settings/bp-settings-functions.php

@@ -215 +215 @@
                 'done' => true,
         );
 }
+
+/**
+ * Fetches a user's personal data request.
+ *
+ * @since 4.0.0
+ *
+ * @param int WP user ID.
+ * @return WP_User_Request|false WP_User_Request object on success, boolean false on failure.
+ */
+function bp_settings_get_personal_data_request( $user_id = 0 ) {
+        if ( empty( $user_id ) ) {
+                $user_id = bp_displayed_user_id();
+        }
+
+        if ( empty( $user_id ) ) {
+                return false;
+        }
+
+        $user = get_userdata( $user_id );
+        if ( empty( $user ) ) {
+                return false;
+        }
+
+        $query = new WP_Query( array(
+                'author'        => (int) $user_id,
+                'post_type'     => 'user_request',
+                'post_status'   => 'any',
+                'post_name__in' => array(
+                        'export_personal_data',
+                ),
+        ) );
+
+        if ( ! empty( $query->post ) ) {
+                return wp_get_user_request_data( $query->post->ID );
+        } else {
+                return false;
+        }
+}
+
+/**
+ * Fetches the expiration date for when a user request expires.
+ *
+ * @since 4.0.0
+ *
+ * @param WP_User_Request $request User request object.
+ * @return string Formatted date.
+ */
+function bp_settings_get_personal_data_expiration_date( WP_User_Request $request ) {
+        /** This filter is documented in wp-admin/includes/file.php */
+        $expiration = apply_filters( 'wp_privacy_export_expiration', 3 * DAY_IN_SECONDS );
+
+        return bp_format_time( $request->completed_timestamp + $expiration, true );
+}
+
+/**
+ * Fetches the confirmation date for a user request object.
+ *
+ * @since 4.0.0
+ *
+ * @param WP_User_Request $request User request object.
+ * @return string Formatted date for the confirmation date.
+ */
+function bp_settings_get_personal_data_confirmation_date( WP_User_Request $request ) {
+        return bp_format_time( $request->confirmed_timestamp, true );
+}
+
+function bp_settings_get_personal_data_export_url( WP_User_Request $request ) {
+        return get_post_meta( $request->ID, '_export_file_url', true );
+}
+
+/**
+ * Check if the generated data export file still exists or not.
+ *
+ * @since 4.0.0
+ *
+ * @param  WP_User_Request $request User request object.
+ * @return bool
+ */
+function bp_settings_personal_data_export_exists( WP_User_Request $request ) {
+        $file = get_post_meta( $request->ID, '_export_file_path', true );
+        if ( file_exists( $file ) ) {
+                return true;
+        } else {
+                return false;
+        }
+}
+
+/**
+ * Template tag to output a list of data exporter items.
+ *
+ * Piggybacks off of the 'wp_privacy_personal_data_exporters' filter and the
+ * 'exporter_friendly_name' key, which is meant for the admin area.
+ *
+ * @todo We should look for a custom key like 'exporter_frontend_name' if available.
+ *
+ * @since 4.0.0
+ */
+function bp_settings_data_exporter_items() {
+        /** This filter is documented in /wp-admin/includes/ajax-actions.php */
+        $exporters = apply_filters( 'wp_privacy_personal_data_exporters', array() );
+
+?>
+        <ul>
+        <?php foreach ( $exporters as $exporter => $data ) :
+                /**
+                 * Filters the data exporter name for display on the "Settings > Data" page.
+                 *
+                 * @since 4.0.0
+                 *
+                 * @param string $name     Data exporter friendly name.
+                 * @param string $exporter Internal exporter name.
+                 */
+                $item = apply_filters( 'bp_settings_data_exporter_name', esc_html( $data['exporter_friendly_name'] ), $exporter );
+        ?>
+
+                <li><?php echo $item; ?></li>
+
+        <?php endforeach; ?>
+        </ul>
+
+<?php
+}

src/bp-settings/classes/class-bp-settings-component.php

@@ -66 +66 @@
                         return;
                 }
 
-                $actions = array( 'notifications', 'capabilities', 'delete-account' );
+                $actions = array( 'notifications', 'capabilities', 'data', 'delete-account' );
 
                 // Authenticated actions.
                 if ( is_user_logged_in() ) {
@@ -183 +183 @@
                         );
                 }
 
+                /**
+                 * Filter whether the site should show the "Settings > Data" page.
+                 *
+                 * @since 4.0.0
+                 *
+                 * @param bool $show Defaults to true.
+                 */
+                $show_data_page = apply_filters( 'bp_settings_show_user_data_page', true );
+
+                // Export Data - only available for WP 4.9.6+.
+                if ( true === $show_data_page && version_compare( $GLOBALS['wp_version'], '4.9.6', '>=' ) ) {
+                        $sub_nav[] = array(
+                                'name'            => __( 'Export Data', 'buddypress' ),
+                                'slug'            => 'data',
+                                'parent_url'      => $settings_link,
+                                'parent_slug'     => $slug,
+                                'screen_function' => 'bp_settings_screen_data',
+                                'position'        => 89,
+                                'user_has_access' => $access,
+                        );
+                }
+
                 // Add Delete Account nav item.
                 if ( ( ! bp_disable_account_deletion() && bp_is_my_profile() ) || bp_current_user_can( 'delete_users' ) ) {
                         $sub_nav[] = array(
@@ -242 +264 @@
                                 );
                         }
 
+                        /** This filter is documented in bp-settings/classes/class-bp-settings-component.php */
+                        $show_data_page = apply_filters( 'bp_settings_show_user_data_page', true );
+
+                        // Export Data.
+                        if ( true === $show_data_page && version_compare( $GLOBALS['wp_version'], '4.9.6', '>=' ) ) {
+                                $wp_admin_nav[] = array(
+                                        'parent'   => 'my-account-' . $this->id,
+                                        'id'       => 'my-account-' . $this->id . '-data',
+                                        'title'    => __( 'Export Data', 'buddypress' ),
+                                        'href'     => trailingslashit( $settings_link . 'data' ),
+                                        'position' => 89,
+                                );
+                        }
+
                         // Delete Account
                         if ( !bp_current_user_can( 'bp_moderate' ) && ! bp_core_get_root_option( 'bp-disable-account-deletion' ) ) {
                                 $wp_admin_nav[] = array(

new file src/bp-settings/screens/data.php

@@ +1 @@
+<?php
+/**
+ * Settings: User's "Settings > Export Data" screen handler
+ *
+ * @package BuddyPress
+ * @subpackage SettingsScreens
+ * @since 4.0.0
+ */
+
+/**
+ * Show the data settings template.
+ *
+ * @since 4.0.0
+ */
+function bp_settings_screen_data() {
+        if ( bp_action_variables() ) {
+                bp_do_404();
+                return;
+        }
+
+        /**
+         * Filters the template file path to use for the data settings screen.
+         *
+         * @since 4.0.0
+         *
+         * @param string $value Directory path to look in for the template file.
+         */
+        bp_core_load_template( apply_filters( 'bp_settings_screen_data', 'members/single/settings/data' ) );
+}

src/bp-templates/bp-legacy/buddypress/members/single/settings.php

@@ -37 +37 @@
         case 'profile'        :
                 bp_get_template_part( 'members/single/settings/profile'        );
                 break;
+        case 'data'           :
+                bp_get_template_part( 'members/single/settings/data'           );
         default:
                 bp_get_template_part( 'members/single/plugins'                 );
                 break;

new file src/bp-templates/bp-legacy/buddypress/members/single/settings/data.php

@@ +1 @@
+<?php
+/**
+ * BuddyPress - Members Settings Data
+ *
+ * @package BuddyPress
+ * @subpackage bp-legacy
+ * @version 4.0.0
+ */
+
+/** This action is documented in bp-templates/bp-legacy/buddypress/members/single/settings/profile.php */
+do_action( 'bp_before_member_settings_template' ); ?>
+
+<h2><?php _e( 'Data Export', 'buddypress' );?></h2>
+
+<?php $request = bp_settings_get_personal_data_request(); ?>
+
+<?php if ( $request ) : ?>
+
+        <?php if ( 'request-completed' === $request->status ) : ?>
+
+                <?php if ( bp_settings_personal_data_export_exists( $request ) ) : ?>
+
+                        <p><?php esc_html_e( 'Your request for an export of personal data has been completed.', 'buddypress' ); ?></p>
+                        <p><?php printf( esc_html__( 'You may download your personal data by clicking on the link below. For privacy and security, we will automatically delete the file on %s, so please download it before then.', 'buddypress' ), bp_settings_get_personal_data_expiration_date( $request ) ); ?></p>
+
+                        <p><strong><?php printf( '<a href="%1$s">%2$s</a>', bp_settings_get_personal_data_export_url( $request ), esc_html__( 'Download personal data', 'buddypress' ) ); ?></strong></p>
+
+                <?php else : ?>
+
+                        <p><?php esc_html_e( 'Your previous request for an export of personal data has expired.', 'buddypress' ); ?></p>
+                        <p><?php esc_html_e( 'Please click on the button below to make a new request.', 'buddypress' ); ?></p>
+
+                        <form id="bp-data-export" method="post">
+                                <input type="hidden" name="bp-data-export-delete-request-nonce" value="<?php echo wp_create_nonce( 'bp-data-export-delete-request' ); ?>" />
+                                <button type="submit" name="bp-data-export-nonce" value="<?php echo wp_create_nonce( 'bp-data-export' ); ?>"><?php esc_html_e( 'Request new data export', 'buddypress' ); ?></button>
+                        </form>
+
+                <?php endif; ?>
+
+        <?php elseif ( 'request-confirmed' === $request->status ) : ?>
+
+                <p><?php printf( esc_html__( 'You previously requested an export of your personal data on %s.', 'buddypress' ), bp_settings_get_personal_data_confirmation_date( $request ) ); ?></p>
+                <p><?php esc_html_e( 'You will receive a link to download your export via email once we are able to fulfill your request.', 'buddypress' ); ?></p>
+
+        <?php endif; ?>
+
+<?php else : ?>
+
+        <p><?php esc_html_e( 'You can request an export of your personal data, containing the following items if applicable:', 'buddypress' ); ?></p>
+
+        <?php bp_settings_data_exporter_items(); ?>
+
+        <p><?php esc_html_e( 'If you want to make a request, please click on the button below:', 'buddypress' ); ?></p>
+
+        <form id="bp-data-export" method="post">
+                <button type="submit" name="bp-data-export-nonce" value="<?php echo wp_create_nonce( 'bp-data-export' ); ?>"><?php esc_html_e( 'Request personal data export', 'buddypress' ); ?></button>
+        </form>
+
+<?php endif; ?>
+
+<!--
+<h2 class="bp-screen-reader-text"><?php
+        /* translators: accessibility text */
+        _e( 'Data Erase', 'buddypress' );
+?></h2>
+
+<p>You can make a request to erase the following type of data from the site:</p>
+
+<p>If you want to make a request, please click on the button below:</p>
+
+        <form id="bp-data-erase" method="post">
+                <button type="submit" name="bp-data-erase-nonce" value="<?php echo wp_create_nonce( 'bp-data-erase' ); ?>">Request data erasure</button>
+        </form>
+-->
+
+<?php
+
+/** This action is documented in bp-templates/bp-legacy/buddypress/members/single/settings/profile.php */
+do_action( 'bp_after_member_settings_template' );

src/bp-templates/bp-nouveau/buddypress/members/single/settings.php

@@ -2 +2 @@
 /**
  * BuddyPress - Users Settings
  *
- * @version 3.0.0
+ * @version 4.0.0
  */
 
 ?>
@@ -39 +39 @@
         case 'invites':
                 bp_get_template_part( 'members/single/settings/group-invites' );
                 break;
+        case 'data':
+                bp_get_template_part( 'members/single/settings/data' );
+                break;
         default:
                 bp_get_template_part( 'members/single/plugins' );
                 break;

new file src/bp-templates/bp-nouveau/buddypress/members/single/settings/data.php

@@ +1 @@
+<?php
+/**
+ * BuddyPress - Members Settings (Export Data)
+ *
+ * @since 3.1.0
+ * @version 3.1.0
+ */
+
+bp_nouveau_member_hook( 'before', 'settings_template' ); ?>
+
+<h2 class="screen-heading data-settings-screen">
+        <?php esc_html_e( 'Data Export', 'buddypress' ); ?>
+</h2>
+
+<?php $request = bp_settings_get_personal_data_request(); ?>
+
+<?php if ( $request ) : ?>
+
+        <?php if ( 'request-completed' === $request->status ) : ?>
+
+                <?php if ( bp_settings_personal_data_export_exists( $request ) ) : ?>
+
+                        <p><?php esc_html_e( 'Your request for an export of personal data has been completed.', 'buddypress' ); ?></p>
+                        <p><?php printf( esc_html__( 'You may download your personal data by clicking on the link below. For privacy and security, we will automatically delete the file on %s, so please download it before then.', 'buddypress' ), bp_settings_get_personal_data_expiration_date( $request ) ); ?></p>
+
+                        <p><strong><?php printf( '<a href="%1$s">%2$s</a>', bp_settings_get_personal_data_export_url( $request ), esc_html__( 'Download personal data', 'buddypress' ) ); ?></strong></p>
+
+                <?php else : ?>
+
+                        <p><?php esc_html_e( 'Your previous request for an export of personal data has expired.', 'buddypress' ); ?></p>
+                        <p><?php esc_html_e( 'Please click on the button below to make a new request.', 'buddypress' ); ?></p>
+
+                        <form id="bp-data-export" method="post">
+                                <input type="hidden" name="bp-data-export-delete-request-nonce" value="<?php echo wp_create_nonce( 'bp-data-export-delete-request' ); ?>" />
+                                <button type="submit" name="bp-data-export-nonce" value="<?php echo wp_create_nonce( 'bp-data-export' ); ?>"><?php esc_html_e( 'Request new data export', 'buddypress' ); ?></button>
+                        </form>
+
+                <?php endif; ?>
+
+        <?php elseif ( 'request-confirmed' === $request->status ) : ?>
+
+                <p><?php printf( esc_html__( 'You previously requested an export of your personal data on %s.', 'buddypress' ), bp_settings_get_personal_data_confirmation_date( $request ) ); ?></p>
+                <p><?php esc_html_e( 'You will receive a link to download your export via email once we are able to fulfill your request.', 'buddypress' ); ?></p>
+
+        <?php endif; ?>
+
+<?php else : ?>
+
+        <p><?php esc_html_e( 'You can request an export of your personal data, containing the following items if applicable:', 'buddypress' ); ?></p>
+
+        <?php bp_settings_data_exporter_items(); ?>
+
+        <p><?php esc_html_e( 'If you want to make a request, please click on the button below:', 'buddypress' ); ?></p>
+
+        <form id="bp-data-export" method="post">
+                <button type="submit" name="bp-data-export-nonce" value="<?php echo wp_create_nonce( 'bp-data-export' ); ?>"><?php esc_html_e( 'Request personal data export', 'buddypress' ); ?></button>
+        </form>
+
+<?php endif; ?>
+
+<h2 class="screen-heading data-settings-screen">
+        <?php esc_html_e( 'Data Erase', 'buddypress' ); ?>
+</h2>
+
+<?php /* translators: Link to Delete Account Settings page */ ?>
+<p><?php esc_html_e( 'To erase all data associated with your account, your user account must be completely deleted.', 'buddypress' ); ?> <?php if ( bp_disable_account_deletion() ) : ?><?php esc_html_e( 'Please contact the site administrator to request account deletion.', 'buddypress' ); ?><?php else : ?><?php printf( esc_html__( 'You may delete your account by visiting the %s page.', 'buddypress' ), sprintf( '<a href="%s">%s</a>', bp_displayed_user_domain() . bp_get_settings_slug() . '/delete-account/', esc_html__( 'Delete Account', 'buddypress' ) ) ); ?><?php endif; ?></p>
+
+<?php
+bp_nouveau_member_hook( 'after', 'settings_template' );

src/bp-templates/bp-nouveau/buddypress/members/single/settings/delete-account.php

@@ -3 +3 @@
  * BuddyPress - Members Settings ( Delete Account )
  *
  * @since 3.0.0
- * @version 3.1.0
+ * @version 4.0.0
  */
 
 bp_nouveau_member_hook( 'before', 'settings_template' ); ?>
@@ -16 +16 @@
 
 <form action="<?php echo esc_url( bp_displayed_user_domain() . bp_get_settings_slug() . '/delete-account' ); ?>" name="account-delete-form" id="#account-delete-form" class="standard-form" method="post">
 
-        <label class="warn" for="delete-account-understand">
-                <input id="delete-account-understand" class="disabled" type="checkbox" name="delete-account-understand" value="1" data-bp-disable-input="#delete-account-button" />
+        <label id="delete-account-understand" class="warn" for="delete-account-understand">
+                <input class="disabled" type="checkbox" name="delete-account-understand" value="1" data-bp-disable-input="#delete-account-button" />
                 <?php esc_html_e( 'I understand the consequences.', 'buddypress' ); ?>
         </label>