Ticket #8167: 8167.1.diff

src/bp-templates/bp-nouveau/includes/groups/ajax.php

@@ -457 +457 @@
  * @since 3.0.0
  */
 function bp_nouveau_ajax_remove_group_invite() {
-        $user_id  = (int) $_POST['user'];
-        $group_id = bp_get_current_group_id();
+        $user_id      = (int) $_POST['user'];
+        $group_id     = bp_get_current_group_id();
+        $current_user = bp_loggedin_user_id();
 
         $response = array(
                 'feedback' => __( 'Group invitation could not be removed.', 'buddypress' ),
@@ -472 +473 @@
 
         // Verify pending invite.
         $invites_args = array(
-                'is_confirmed' => false,
-                'is_banned'    => null,
-                'is_admin'     => null,
-                'is_mod'       => null,
+                'user_id' => $user_id,
+                'item_id' => $group_id,
         );
-        $invites = bp_get_user_groups( $user_id, $invites_args );
+        $invites = groups_get_invites( $invites_args );
         if ( empty( $invites ) ) {
                 wp_send_json_error( $response );
         }
 
-        if ( ! groups_is_user_admin( bp_loggedin_user_id(), $group_id ) ) {
+        // A site moderator, group admin or the inviting user should be able to remove an invitation.
+
+        // Is the current user the inviter?
+        $is_inviter = false;
+        $inviter_id = false;
+        foreach ( $invites as $invite ) {
+                if ( $current_user == $invite->inviter_id ) {
+                        $is_inviter = true;
+                        // Set the inviter ID so we delete the correct invitation.
+                        $inviter_id = $invite->inviter_id;
+                        break;
+                }
+        }
+
+        if ( ! bp_current_user_can( 'bp_moderate' ) && ! groups_is_user_admin( bp_loggedin_user_id(), $group_id ) && ! $is_inviter ) {
                 wp_send_json_error( $response );
         }
 
@@ -497 +510 @@
         }
 
         // Remove the unsent invitation.
-        if ( ! groups_uninvite_user( $user_id, $group_id ) ) {
+        if ( ! groups_uninvite_user( $user_id, $group_id, $inviter_id ) ) {
                 wp_send_json_error(
                         array(
                                 'feedback' => __( 'Group invitation could not be removed.', 'buddypress' ),