Ticket #8728: 8728.04.patch

src/bp-core/admin/bp-core-admin-settings.php

@@ -349 +349 @@
 <?php
 }
 
+/**
+ * 'Enable group activity deletions.
+ *
+ * @since 14.0.0
+ */
+function bp_admin_setting_callback_group_activity_deletions() {
+?>
+        <input id="bp-enable-group-activity-deletions" name="bp-enable-group-activity-deletions" type="checkbox" value="1" <?php checked( bp_enable_group_activity_deletions() ); ?> />
+        <label for="bp-enable-group-activity-deletions"><?php esc_html_e( "Allow group administrators and moderators to delete activity items from their group's activity stream", 'buddypress' ); ?></label>
+<?php
+}
+
 /** Account settings Section ************************************************************/
 
 /**

src/bp-core/bp-core-options.php

@@ -62 +62 @@
                 // Group Cover image uploads.
                 'bp-disable-group-cover-image-uploads' => false,
 
+                // Allow Group Activity Deletions.
+                'bp-enable-group-activity-deletions'   => false,
+
                 // Allow users to delete their own accounts.
                 'bp-disable-account-deletion'          => false,
 
@@ -585 +588 @@
         return (bool) apply_filters( 'bp_disable_group_cover_image_uploads', (bool) bp_get_option( 'bp-disable-group-cover-image-uploads', $default ) );
 }
 
+/**
+ * Are group activity deletions enabled?
+ *
+ * @since 14.0.0
+ *
+ * @param bool $default Optional. Fallback value if not found in the database.
+ *                      Default: false.
+ * @return bool True if group activity deletions are enabled, otherwise false.
+ */
+function bp_enable_group_activity_deletions( $default = false ) {
+
+        /**
+         * Filters whether or not group creator, group admin or group mod are able to delete group activity posts.
+         *
+         * @since 14.0.0
+         *
+         * @param bool $value Whether or not group creator, group admin or group mod are able to delete group activity post.
+         */
+        return (bool) apply_filters( 'bp_enable_group_activity_deletions', (bool) bp_get_option( 'bp-enable-group-activity-deletions', $default ) );
+}
+
 /**
  * Are members able to delete their own accounts?
  *

src/bp-core/classes/class-bp-admin.php

@@ -567 +567 @@
                                 add_settings_field( 'bp-disable-group-cover-image-uploads', __( 'Group Cover Image Uploads', 'buddypress' ), 'bp_admin_setting_callback_group_cover_image_uploads', 'buddypress', 'bp_groups' );
                                 register_setting( 'buddypress', 'bp-disable-group-cover-image-uploads', 'intval' );
                         }
+
+                        // Allow group activity deletions.
+                        add_settings_field( 'bp-enable-group-activity-deletions', esc_html__( 'Group Activity Deletions', 'buddypress' ), 'bp_admin_setting_callback_group_activity_deletions', 'buddypress', 'bp_groups' );
+                        register_setting( 'buddypress', 'bp-enable-group-activity-deletions', 'intval' );
                 }
 
                 /* Activity Section **************************************************/

src/bp-groups/bp-groups-activity.php

@@ -650 +650 @@
  * @return bool
  */
 function bp_groups_filter_activity_user_can_delete( $retval, $activity ) {
-        // Bail if no current user.
-        if ( ! is_user_logged_in() ) {
+        // Bail if no current user or group activity deletions are disabled.
+        if ( ! is_user_logged_in() || ! bp_enable_group_activity_deletions() ) {
                 return $retval;
         }
 
-        if ( isset( $activity->component ) || 'groups' !== $activity->component ) {
+        if ( isset( $activity->component ) && 'groups' !== $activity->component ) {
                 return $retval;
         }
 
-        // Trust the passed value for administrators.
-        if ( bp_current_user_can( 'bp_moderate' ) ) {
+        // The first conditional statement will trust the passed value for administrators.
+        // The second conditional statement does not allow "site admin" activity posts to be deleted by "non site admins".
+        if ( bp_current_user_can( 'bp_moderate' ) || bp_user_can( $activity->user_id, 'bp_moderate' ) ) {
                 return $retval;
         }
 
-        // Group administrators or moderators can delete content in that group that doesn't belong to them.
         $group_id = $activity->item_id;
+
+        // Group administrators or moderators can delete content in which deletions are allowed for that group.
         if ( groups_is_user_admin( bp_loggedin_user_id(), $group_id ) || groups_is_user_mod( bp_loggedin_user_id(), $group_id ) ) {
                 $retval = true;
         }