Ticket #8734: 8734.02.patch

src/bp-core/admin/bp-core-admin-settings.php

@@ -47 +47 @@
 <?php
 }
 
+/**
+ * Enable private site functionality.
+ *
+ * @since 12.0.0
+ *
+ */
+function bp_admin_setting_callback_community_visibility() {
+        $visibility      = bp_community_visibility_get_visibility();
+        $directory_pages = bp_core_get_directory_pages();
+?>
+        <fieldset class="community-visibility-setting">
+                <legend><?php esc_html_e( 'Global (Fallback) Setting', 'buddypress' ); ?></legend>
+                <label for="_bp_community_visibility-global-anyone"><input type="radio" id="_bp_community_visibility-global-anyone" name="_bp_community_visibility[global]" value="anyone" <?php checked( $visibility['global'], 'anyone' ); ?>/> <?php esc_html_e( 'Anyone', 'buddypress' ); ?></label>
+                <label for="_bp_community_visibility-global-members"><input type="radio" id="_bp_community_visibility-global-members" name="_bp_community_visibility[global]" value="members" <?php checked( $visibility['global'], 'members' ); ?>/> <?php esc_html_e( 'Members Only', 'buddypress' ); ?></label>
+        </fieldset>
+
+        <?php foreach ( $directory_pages as $component_id => $component_page ) : 
+                // Register and Activate must not be private.
+                if ( in_array( $component_id, array( 'register', 'activate' ) ) ) {
+                        continue;
+                }
+                ?>
+                <fieldset class="community-visibility-setting">
+                        <legend><?php esc_html_e( $component_page->title, 'buddypress' ); ?></legend>
+                        <label for="_bp_community_visibility-<?php echo esc_attr( $component_id ); ?>-anyone"><input type="radio" id="_bp_community_visibility-<?php echo esc_attr( $component_id ); ?>-anyone" name="_bp_community_visibility[<?php echo esc_attr( $component_id ); ?>]" value="anyone" <?php checked( $visibility[ $component_id ], 'anyone' ); ?>/> <?php esc_html_e( 'Anyone', 'buddypress' ); ?></label>
+                        <label for="_bp_community_visibility-<?php echo esc_attr( $component_id ); ?>-members"><input type="radio" id="_bp_community_visibility-<?php echo esc_attr( $component_id ); ?>-members" name="_bp_community_visibility[<?php echo esc_attr( $component_id ); ?>]" value="members" <?php checked( $visibility[ $component_id ], 'members' ); ?>/> <?php esc_html_e( 'Members Only', 'buddypress' ); ?></label>
+                </fieldset>
+        <?php endforeach; ?>
+
+        <p id="_bp_community_visibility_description" class="description"><?php esc_html_e( 'Choose "Anyone" to allow any visitor access to your community area. Choose "Members" to restrict access to your community area to logged-in members only. The global setting is used when a more specific setting is not available.', 'buddypress' ); ?></p>
+<?php
+}
+
 /**
  * Form element to change the active template pack.
  */
@@ -306 +339 @@
 <?php
 }
 
+/** Community Visibility ******************************************************/
+
+/**
+ * Groups settings section description for the settings page.
+ *
+ * @since 12.0.0
+ */
+function bp_admin_setting_callback_community_visibility_section() { }
+
+
 /** Settings Page *************************************************************/
 
 /**

src/bp-core/admin/css/common.css

@@ -713 +713 @@
                 width: auto;
         }
 }
+
+/* Community Visibility */
+fieldset.community-visibility-setting {
+        padding: 2px 6px;
+}
+fieldset.community-visibility-setting:nth-of-type(2n+1) {
+        background: #fafafa;
+}
+fieldset.community-visibility-setting legend,
+fieldset.community-visibility-setting label {
+        float: left;
+}
+fieldset.community-visibility-setting legend {
+        margin: 0.35em 0 0.5em;
+        width: 50%;
+        font-weight: 600;
+}
+fieldset.community-visibility-setting label {
+        width: 24%;
+}

src/bp-core/bp-core-caps.php

@@ -124 +124 @@
  * Map community caps to built in WordPress caps.
  *
  * @since 1.6.0
+ * @since 12.0.0 Added mapping for `bp_read` capability.
  *
  * @see WP_User::has_cap() for description of the arguments passed to the
  *      'map_meta_cap' filter.
@@ -137 +138 @@
  */
 function bp_map_meta_caps( $caps, $cap, $user_id, $args ) {
 
+        switch ( $cap ) {
+                case 'bp_read' :
+                        $caps = array( 'exist' );
+                        break;
+        }
+
         /**
          * Filters the community caps mapping to be built in WordPress caps.
          *

new file src/bp-core/bp-core-community-visibility.php

@@ +1 @@
+<?php
+/**
+ * Core community visibility functions.
+ *
+ * @package BuddyPress
+ * @subpackage CommunityVisibility
+ * @since 12.0.0
+ */
+
+// Exit if accessed directly.
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * The main change on a private site is that visitors who are not
+ * logged in may not have the `bp_read` capability.
+ *
+ * @since 12.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_community_visibility_user_can_filter( $retval, $user_id, $capability, $site_id, $args ) {
+        switch ( $capability ) {
+                case 'bp_read':
+                        if ( ! $user_id ) {
+                                $component = $args['bp_component'] ?? '';
+
+                                if ( $component && 'members' === bp_community_visibility_get_visibility( $component ) ) {
+                                        $retval = false;
+                                }
+
+                                /**
+                                 * Filters the private site capability.
+                                 *
+                                 * @since 12.0.0
+                                 *
+                                 * @param bool   $retval     Whether or not the current user has the capability.
+                                 * @param int    $user_id
+                                 * @param string $capability The capability being checked for.
+                                 * @param int    $site_id    Site ID. Defaults to the BP root blog.
+                                 * @param array  $args       Array of extra arguments passed.
+                                 */
+                                $retval = apply_filters( 'bp_private_site_user_can_filter', $retval, $user_id, $capability, $site_id, $args );
+                        }
+                        break;
+        }
+
+        return $retval;
+}
+add_filter( 'bp_user_can', 'bp_community_visibility_user_can_filter', 10, 5 );
+
+/**
+ * Set default permissions for the BP REST API.
+ *
+ * @since 12.0.0
+ */
+function bp_community_visibility_rest_set_default_permission_checks() {
+        $visibility_settings = bp_community_visibility_get_visibility();
+
+        foreach ( $visibility_settings as $component_id => $setting ) {
+                if ( 'global' === $component_id || 'anyone' === $setting ) {
+                        continue;
+                }
+
+                if ( 'xprofiles' === $component_id ) {
+                        add_filter( 'bp_rest_xprofile_field_groups_get_items_permissions_check', 'bp_community_visibility_rest_check_default_permission', 1, 2 );
+                        add_filter( 'bp_rest_xprofile_fields_get_items_permissions_check', 'bp_community_visibility_rest_check_default_permission', 1, 2 );
+                } else {
+                        add_filter( "bp_rest_{$component_id}_get_items_permissions_check", 'bp_community_visibility_rest_check_default_permission', 1, 2 );
+                }
+        }
+}
+add_action( 'bp_rest_api_init', 'bp_community_visibility_rest_set_default_permission_checks', 1 );
+
+/**
+ * Checks if a natively "public" BP REST request can be performed.
+ *
+ * @since 12.0.0
+ *
+ * @param true            $retval  Returned value.
+ * @param WP_REST_Request $request The request sent to the API.
+ * @return bool True if the user has access. False otherwise.
+ */
+function bp_community_visibility_rest_check_default_permission( $retval, $request ) {
+        $path         = wp_parse_url( $request->get_route(), PHP_URL_PATH );
+        $component_id = trim( str_replace( bp_rest_namespace() . '/' . bp_rest_version(), '', trim( $path, '/' ) ), '/' );
+        $args         = array();
+
+        if ( $component_id ) {
+                $args['bp_component'] = $component_id;
+        }
+
+        return bp_current_user_can( 'bp_read', $args );
+}
+
+/**
+ * Should RSS feeds for activity be enabled?
+ *
+ * @since 12.0.0
+ *
+ * @param bool   $feed_enabled True if feeds are enabled. Default true.
+ * @param string $feed_id      The feed identifier.
+ */
+function bp_community_visibility_rss_feed_access_protection( $feed_enabled, $feed_id ) {
+        // @TODO: I'm not sure this is adequate, since feeds are about other components, too.
+        // From the hook, "possible feed_ids are 'sitewide', 'personal', 'friends', 'mygroups', 'mentions', 'favorites'"
+        // Which component should those other items refer to?
+        if ( ! bp_current_user_can( 'bp_read', array( 'bp_component' => 'activity' ) ) ) {
+                /**
+                 * Allow plugins to allow specific feeds even when community visibility is limited.
+                 *
+                 * @since 12.0.0
+                 *
+                 * @param bool  $feed_enabled True to allow access to the feed.
+                 * @param array $feed_id      The feed identifier.
+                 */
+                $feed_enabled = apply_filters( 'bp_community_visibility_rss_feed_access_protection', false, $feed_id );
+        }
+        return $feed_enabled;
+}
+add_filter( 'bp_activity_enable_feeds', 'bp_community_visibility_rss_feed_access_protection', 10, 2 );
+
+/**
+ * Get the community visibility value calculated from the 
+ * saved visibility setting.
+ *
+ * @since 12.0.0
+ *
+ * @param string $component Whether we want the visibility for a component 
+ *                          or for all components.
+ * 
+ * @return arrary|string $retval The calculated visbility settings for the site.
+ */
+function bp_community_visibility_get_visibility( $component = 'all' ) {
+        $retval      = 'anyone';
+        $saved_value = get_option( '_bp_community_visibility' );
+
+        // If the global value has not been set, we assume that the site is open.
+        if ( ! isset( $saved_value['global'] ) ) {
+                $saved_value['global'] = 'anyone';
+        }
+
+        if ( 'all' === $component ) {
+                // Build the component list.
+                $retval = array( 
+                        'global' => $saved_value['global'] 
+                );
+                $directory_pages = bp_core_get_directory_pages();
+                foreach ( $directory_pages as $component_id => $component_page ) {
+                        if ( in_array( $component_id, array( 'register', 'activate' ), true ) ) {
+                                continue;
+                        }
+                        $retval[ $component_id ] = $saved_value[ $component_id ] ?? $saved_value['global'];
+                }
+        } else {
+                // We are checking a particular component.
+                // Fall back to the global value if not set.
+                $retval = $saved_value[ $component ] ?? $saved_value['global'];
+        }
+
+        /**
+         * Filter the community visibility value calculated from the 
+         * saved visibility setting.
+         *
+         * @since 12.0.0
+         *
+         * @param arrary|string $retval    The calculated visbility settings for the site.
+         * @param string        $component The component value to get the visibility for.
+         */
+        return apply_filters( 'bp_community_visibility_get_visibility', $retval, $component );
+}
+
+/**
+ * Sanitize the visibility setting when it is saved.
+ * 
+ * @since 12.0.0
+ * 
+ * @param mixed $saved_value The value passed to the save function.
+ */
+function bp_community_visibility_sanitize_setting( $saved_value ) {
+        $retval = array();
+
+        // Use the global setting, if it has been passed.
+        $retval['global'] = $saved_value['global'] ?? 'anyone';
+        // Ensure the global value is a valid option. Else, assume that the site is open.
+        if ( ! in_array( $retval['global'], array( 'anyone', 'members' ), true ) ) {
+                $retval['global'] = 'anyone';
+        }
+
+        // Keys must be either 'global' or a component ID, but not register or activate.
+        $directory_pages = bp_core_get_directory_pages();
+        foreach ( $directory_pages as $component_id => $component_page ) {
+                if ( in_array( $component_id, array( 'register', 'activate' ), true ) ) {
+                        continue;
+                }
+
+                // Use the global value if a specific value hasn't been set.
+                $component_value = $saved_value[ $component_id ] ?? $retval['global'];
+
+                // Valid values are 'anyone' or 'memebers'.
+                if ( ! in_array( $component_value, array( 'anyone', 'members' ), true ) ) {
+                        $component_value = $retval['global'];
+                }
+                $retval[ $component_id ] = $component_value;
+        }
+
+        return $saved_value;
+}

src/bp-core/bp-core-functions.php

@@ -668 +668 @@
         return $page_id;
 }
 
+/**
+ * Get the component ID corresponding to a directory page ID.
+ *
+ * @since 12.0.0
+ *
+ * @param int $page_id The ID of the directory page associated with the component.
+ * @return int|false The slug representing the component. False if none is found.
+ */
+function bp_core_get_component_from_directory_page_id( $page_id = 0 ) {
+        $bp_pages = bp_core_get_directory_page_ids( 'all' );
+
+        $component = false;
+        foreach ( $bp_pages as $component_id => $p_id) {
+                if ( $page_id === $p_id ) {
+                        $component = $component_id;
+                        break;
+                }
+        }
+
+        return $component;
+}
+
 /**
  * Store the list of BP directory pages in the appropriate meta table.
  *

src/bp-core/classes/class-bp-admin.php

@@ -562 +562 @@
                                 register_setting( 'buddypress', '_bp_enable_akismet', 'intval' );
                         }
                 }
+
+                /* Community Visibility ************************************************/
+                add_settings_section( 'bp_community_visibility', __( 'Community Visibility', 'buddypress' ), 'bp_admin_setting_callback_community_visibility_section', 'buddypress' );
+
+                add_settings_field( '_bp_community_visibility', __( 'Visibility by Component', 'buddypress' ), 'bp_admin_setting_callback_community_visibility', 'buddypress', 'bp_community_visibility' );
+                register_setting( 'buddypress', '_bp_community_visibility', 'bp_community_visibility_sanitize_setting' );
         }
 
         /**

src/bp-core/classes/class-bp-component.php

@@ -1268 +1268 @@
                 $queried_object = $query->get_queried_object();
 
                 if ( $queried_object instanceof WP_Post && 'buddypress' === get_post_type( $queried_object ) ) {
-                        // Only include the queried directory post into returned posts.
-                        $retval = array( $queried_object );
-
-                        // Reset some query flags.
-                        $query->is_home       = false;
-                        $query->is_front_page = false;
-                        $query->is_page       = false;
-                        $query->is_archive    = false;
-                        $query->is_tax        = false;
-
-                        if ( ! is_embed() ) {
-                                $query->is_single = true;
+                        $component = bp_core_get_component_from_directory_page_id( $queried_object->ID );
+                        if ( $component && bp_current_user_can( 'bp_read', array( 'bp_component' => $component ) ) ) {
+                                // Only include the queried directory post into returned posts.
+                                $retval = array( $queried_object );
+
+                                // Reset some query flags.
+                                $query->is_home       = false;
+                                $query->is_front_page = false;
+                                $query->is_page       = false;
+                                $query->is_archive    = false;
+                                $query->is_tax        = false;
+
+                                if ( ! is_embed() ) {
+                                        $query->is_single = true;
+                                }
+                        } else {
+                                // The current user may not access the directory page.
+                                $bp                    = buddypress();
+                                $bp->current_component = 'core';
+
+                                // Unset other BuddyPress URI globals.
+                                foreach ( array( 'current_item', 'current_action', 'action_variables', 'displayed_user' ) as $global ) {
+                                        if ( 'action_variables' === $global ) {
+                                                $bp->{$global} = array();
+                                        } elseif ( 'displayed_user' === $global ) {
+                                                $bp->{$global} = new \stdClass();
+                                        } else {
+                                                $bp->{$global} = '';
+                                        }
+                                }
+
+                                // Reset the post.
+                                $post = (object) array(
+                                        'ID'             => 0,
+                                        'post_type'      => 'buddypress',
+                                        'post_name'      => 'restricted',
+                                        'post_title'     => __( 'Members-only area', 'bp-rewrites' ),
+                                        'post_content'   => bp_buffer_template_part( 'assets/utils/restricted-access-message', null, false ),
+                                        'comment_status' => 'closed',
+                                        'comment_count'  => 0,
+                                );
+
+                                // Reset the queried object.
+                                $query->queried_object    = get_post( $post );
+                                $query->queried_object_id = $query->queried_object->ID;
+
+                                // Reset the posts.
+                                $retval = array( $query->queried_object );
+
+                                // Reset some WP Query properties.
+                                $query->found_posts   = 1;
+                                $query->max_num_pages = 1;
+                                $query->posts         = $posts;
+                                $query->post          = $post;
+                                $query->post_count    = 1;
+                                $query->is_home       = false;
+                                $query->is_front_page = false;
+                                $query->is_page       = false;
+                                $query->is_single     = true;
+                                $query->is_archive    = false;
+                                $query->is_tax        = false;
+
+                                // Make sure no comments are displayed for this page.
+                                add_filter( 'comments_pre_query', 'bp_comments_pre_query', 10, 2 );
+
+                                // @TODO: From bp-rewrites, meant to improve the button coloration.
+                                // if ( function_exists( 'wp_get_global_styles' ) ) {
+                                //      add_action( 'bp_enqueue_community_scripts', __NAMESPACE__ . '\add_bp_login_block_inline_style' );
+                                // }
                         }
-                }
 
-                return $retval;
+                        return $retval;
+                }
         }
 
         /**

new file src/bp-templates/bp-legacy/buddypress/assets/utils/restricted-access-message.php

@@ +1 @@
+<?php
+/**
+ * Message to inform the community is restricted to members.
+ *
+ * @package BuddyPress
+ * @subpackage bp-legacy
+ *
+ * @since 12.0.0
+ */
+
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+        exit;
+}
+?>
+<!-- wp:paragraph {"align":"center"} -->
+<p class="has-text-align-center"><?php esc_html_e( 'This community area is accessible to logged-in members only.', 'bp-rewrites' ); ?></p>
+<!-- /wp:paragraph -->
+
+<!-- wp:columns -->
+<div class="wp-block-columns"><!-- wp:column {"width":"25%"} -->
+<div class="wp-block-column" style="flex-basis:25%"></div>
+<!-- /wp:column -->
+
+<!-- wp:column {"width":"50%"} -->
+<div class="wp-block-column" style="flex-basis:50%"><!-- wp:bp/login-form {"forgotPwdLink":true} /--></div>
+<!-- /wp:column -->
+
+<!-- wp:column {"width":"25%"} -->
+<div class="wp-block-column" style="flex-basis:25%"></div>
+<!-- /wp:column --></div>
+<!-- /wp:columns -->

new file src/bp-templates/bp-nouveau/buddypress/assets/utils/restricted-access-message.php

@@ +1 @@
+<?php
+/**
+ * Message to inform the community is restricted to members.
+ *
+ * @package BuddyPress
+ * @subpackage bp-nouveau
+ *
+ * @since 12.0.0
+ */
+
+// Exit if accessed directly.
+if ( ! defined( 'ABSPATH' ) ) {
+        exit;
+}
+?>
+<!-- wp:paragraph {"align":"center"} -->
+<p class="has-text-align-center"><?php esc_html_e( 'This community area is accessible to logged-in members only.', 'bp-rewrites' ); ?></p>
+<!-- /wp:paragraph -->
+
+<!-- wp:columns -->
+<div class="wp-block-columns"><!-- wp:column {"width":"25%"} -->
+<div class="wp-block-column" style="flex-basis:25%"></div>
+<!-- /wp:column -->
+
+<!-- wp:column {"width":"50%"} -->
+<div class="wp-block-column" style="flex-basis:50%"><!-- wp:bp/login-form {"forgotPwdLink":true} /--></div>
+<!-- /wp:column -->
+
+<!-- wp:column {"width":"25%"} -->
+<div class="wp-block-column" style="flex-basis:25%"></div>
+<!-- /wp:column --></div>
+<!-- /wp:columns -->

src/class-buddypress.php

@@ -644 +644 @@
                 require $this->plugin_dir . 'bp-core/bp-core-customizer-email.php';
                 require $this->plugin_dir . 'bp-core/bp-core-rest-api.php';
                 require $this->plugin_dir . 'bp-core/bp-core-blocks.php';
+                require $this->plugin_dir . 'bp-core/bp-core-community-visibility.php';
 
                 // Get the list of versions needing their deprecated functions to be loaded.
                 $deprecated_functions_versions = bp_get_deprecated_functions_versions();

new file tests/phpunit/testcases/core/community-visibility.php

@@ +1 @@
+<?php
+/**
+ * @group bp_community_visibility
+ */
+class BP_Tests_BP_Community_Visibility_TestCases extends BP_UnitTestCase {
+        protected $old_user;
+        protected $logged_in_user;
+
+        public function set_up() {
+                parent::set_up();
+                $this->old_user = get_current_user_id();
+                $this->logged_in_user = self::factory()->user->create();
+                $this->set_current_user( $this->logged_in_user );
+
+                // Save a typical setting.
+                $setting = array(
+                        'global'      => 'anyone',
+                        'members'     => 'anyone',
+                        'attachments' => 'anyone',
+                        'activity'    => 'members',
+                        'groups'      => 'members'
+                );
+                update_option( '_bp_community_visibility', $setting );
+        }
+
+        public function tear_down() {
+                parent::tear_down();
+                $this->set_current_user( $this->old_user );
+        }
+
+        // Test that logged-in user has access to component marked anyone and component marked members
+        public function test_bp_community_visibility_allow_visibility_for_logged_in_user() {
+                $this->assertTrue( bp_user_can( $this->logged_in_user, 'bp_read', array( 'bp_component' => 'members' ) ) );
+                $this->assertTrue( bp_user_can( $this->logged_in_user, 'bp_read', array( 'bp_component' => 'groups' ) ) );
+        }
+
+        // Test that anonymous user has access to component marked anyone but not component marked members
+        public function test_bp_community_visibility_enforce_visibility_for_anon_user() {
+                $this->assertTrue( bp_user_can( 0, 'bp_read', array( 'bp_component' => 'members' ) ) );
+                $this->assertFalse( bp_user_can( 0, 'bp_read', array( 'bp_component' => 'groups' ) ) );
+        }
+
+        // No component or bad component should be open.
+        public function test_bp_community_visibility_bad_component_id() {
+                $this->assertTrue( bp_user_can( 0, 'bp_read' ) );
+                $this->assertTrue( bp_user_can( $this->logged_in_user, 'bp_read' ) );
+                $this->assertTrue( bp_user_can( 0, 'bp_read', array( 'bp_component' => 'blerg' ) ) );
+                $this->assertTrue( bp_user_can( $this->logged_in_user, 'bp_read', array( 'bp_component' => 'blerg' ) ) );
+        }
+
+        // No saved setting should be open access for anonymous users and logged in users.
+        public function test_bp_community_visibility_no_saved_setting() {
+                delete_option( '_bp_community_visibility' );
+                // No saved setting should result in the site being open to anyone.
+                $this->assertTrue( bp_user_can( 0, 'bp_read', array( 'bp_component' => 'groups' ) ) );
+                $this->assertTrue( bp_user_can( $this->logged_in_user, 'bp_read', array( 'bp_component' => 'groups' ) ) );
+        }
+
+        // Make sure fallback logic works for mixed-up setting values.
+        public function test_bp_community_visibility_fallback_setting() {
+                // Save a partial setting.
+                $setting = array(
+                        'global'      => 'members',
+                        'members'     => 'anyone',
+                );
+                update_option( '_bp_community_visibility', $setting );
+                $this->assertTrue( 'members' === bp_community_visibility_get_visibility( 'groups' ) );
+        }
+}