Ticket #8794: 8794-bp-moderate.1.diff

src/bp-activity/bp-activity-admin.php

@@ -95 +95 @@
         }
 
         // @todo: Check if user is allowed to create new activity items
-        // if ( ! current_user_can( 'bp_new_activity' ) )
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_activity_manage_activity_items' ) ) {
                 die( '-1' );
         }
 
@@ -626 +625 @@
  */
 function bp_activity_admin_delete() {
 
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_activity_manage_activity_items' ) ) {
                 die( '-1' );
         }
 

src/bp-activity/bp-activity-filters.php

@@ -844 +844 @@
 
         return $exporters;
 }
+
+/**
+ * Filter the bp_user_can value to determine what the user can do
+ * with regards to the activity component.
+ *
+ * @since 15.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_activity_user_can_filter( $retval, $user_id, $capability, $site_id, $args ) {
+        switch ( $capability ) {
+                case 'bp_activity_manage_activity_items':
+                // @TODO: Improve check for whether user can create a new activity item.
+                case 'bp_activity_is_item_admin':
+
+                        // Fall back to the bp_moderate capability.
+                        $retval = bp_user_can( $user_id, 'bp_moderate' );
+
+                        break;
+        }
+
+        return $retval;
+}
+add_filter( 'bp_user_can', 'bp_activity_user_can_filter', 10, 5 );

src/bp-activity/bp-activity-template.php

@@ -221 +221 @@
         if ( bp_is_group() ) {
                 $object      = $bp->groups->id;
                 $primary_id  = bp_get_current_group_id();
-                $show_hidden = (bool) ( groups_is_user_member( bp_loggedin_user_id(), $primary_id ) || bp_current_user_can( 'bp_moderate' ) );
+                $show_hidden = (bool) ( groups_is_user_member( bp_loggedin_user_id(), $primary_id ) || bp_current_user_can( 'bp_groups_view_hidden_groups' ) );
         } else {
                 $object      = false;
                 $primary_id  = false;

src/bp-activity/screens/favorites.php

@@ -13 +13 @@
  * @since 1.2.0
  */
 function bp_activity_screen_favorites() {
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'bp_activity_is_item_admin' ), 'activity' );
 
         /**
          * Fires right before the loading of the "Favorites" screen template file.

src/bp-activity/screens/friends.php

@@ -17 +17 @@
                 return;
         }
 
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'bp_activity_is_item_admin' ), 'activity' );
 
         /**
          * Fires right before the loading of the "My Friends" screen template file.

src/bp-activity/screens/groups.php

@@ -17 +17 @@
                 return;
         }
 
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'bp_activity_is_item_admin' ), 'activity' );
 
         /**
          * Fires right before the loading of the "My Groups" screen template file.

src/bp-activity/screens/mentions.php

@@ -13 +13 @@
  * @since 1.2.0
  */
 function bp_activity_screen_mentions() {
-        bp_update_is_item_admin( bp_current_user_can( 'bp_moderate' ), 'activity' );
+        bp_update_is_item_admin( bp_current_user_can( 'bp_activity_is_item_admin' ), 'activity' );
 
         /**
          * Fires right before the loading of the "Mentions" screen template file.

src/bp-blogs/bp-blogs-filters.php

@@ -290 +290 @@
         return $response;
 }
 add_filter( 'rest_post_dispatch', 'bp_rest_post_dispatch', 10, 3 );
+
+/**
+ * Filter the bp_user_can value to determine what the user can do
+ * with regards to the blogs component.
+ *
+ * @since 15.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_blogs_user_can_filter( $retval, $user_id, $capability, $site_id, $args ) {
+        switch ( $capability ) {
+                case 'bp_blogs_view_others_hidden_blogs':
+                        // Fall back to the bp_moderate capability.
+                        $retval = bp_user_can( $user_id, 'bp_moderate' );
+                        break;
+        }
+
+        return $retval;
+}
+add_filter( 'bp_user_can', 'bp_blogs_user_can_filter', 10, 5 );
+ No newline at end of file

src/bp-blogs/classes/class-bp-blogs-blog.php

@@ -246 +246 @@
                         )
                 );
 
-                if ( ! is_user_logged_in() || ( ! bp_current_user_can( 'bp_moderate' ) && ( $r['user_id'] != bp_loggedin_user_id() ) ) ) {
+                if ( ! is_user_logged_in() || ( ! bp_current_user_can( 'bp_blogs_view_others_hidden_blogs' ) && ( $r['user_id'] != bp_loggedin_user_id() ) ) ) {
                         $hidden_sql = 'AND wb.public = 1';
                 } else {
                         $hidden_sql = '';
@@ -513 +513 @@
          * Return a count of associated blogs for a given user.
          *
          * Includes hidden blogs when the logged-in user is the same as the
-         * $user_id parameter, or when the logged-in user has the bp_moderate
-         * cap.
+         * $user_id parameter, or when the logged-in user has the capability to
+         * views others' hidden blogs.
          *
          * @global wpdb $wpdb WordPress database object.
          *
@@ -532 +532 @@
                 }
 
                 // If the user is logged in return the blog count including their hidden blogs.
-                if ( ( is_user_logged_in() && $user_id === bp_loggedin_user_id() ) || bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ( is_user_logged_in() && $user_id === bp_loggedin_user_id() ) || bp_current_user_can( 'bp_blogs_view_others_hidden_blogs' ) ) {
                         return $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(DISTINCT b.blog_id) FROM {$bp->blogs->table_name} b LEFT JOIN {$wpdb->base_prefix}blogs wb ON b.blog_id = wb.blog_id WHERE wb.deleted = 0 AND wb.spam = 0 AND wb.mature = 0 AND wb.archived = '0' AND user_id = %d", $user_id ) );
                 }
 
@@ -563 +563 @@
                 $search_terms_sql  = $wpdb->prepare( 'bm.meta_value LIKE %s', $search_terms_like );
 
                 $hidden_sql = '';
-                if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! bp_current_user_can( 'bp_blogs_view_others_hidden_blogs' ) ) {
                         $hidden_sql = 'AND wb.public = 1';
                 }
 
@@ -592 +592 @@
          * Retrieve a list of all blogs.
          *
          * Query will include hidden blogs if the logged-in user has the
-         * 'bp_moderate' cap.
+         * 'bp_blogs_view_others_hidden_blogs' cap.
          *
          * @global wpdb $wpdb WordPress database object.
          *
@@ -609 +609 @@
 
                 $bp = buddypress();
 
-                $hidden_sql = ! bp_current_user_can( 'bp_moderate' ) ? 'AND wb.public = 1' : '';
+                $hidden_sql = ! bp_current_user_can( 'bp_blogs_view_others_hidden_blogs' ) ? 'AND wb.public = 1' : '';
                 $pag_sql    = ( $limit && $page ) ? $wpdb->prepare( ' LIMIT %d, %d', intval( ( $page - 1 ) * $limit ), intval( $limit ) ) : '';
 
                 $paged_blogs = $wpdb->get_results( "SELECT DISTINCT b.blog_id FROM {$bp->blogs->table_name} b LEFT JOIN {$wpdb->base_prefix}blogs wb ON b.blog_id = wb.blog_id WHERE wb.mature = 0 AND wb.spam = 0 AND wb.archived = '0' AND wb.deleted = 0 {$hidden_sql} {$pag_sql}" );
@@ -630 +630 @@
          * Retrieve a list of blogs whose names start with a given letter.
          *
          * Query will include hidden blogs if the logged-in user has the
-         * 'bp_moderate' cap.
+         * 'bp_blogs_view_others_hidden_blogs' cap.
          *
          * @global wpdb $wpdb WordPress database object.
          *
@@ -652 +652 @@
                 $letter_sql  = $wpdb->prepare( 'bm.meta_value LIKE %s', $letter_like );
 
                 $hidden_sql = '';
-                if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! bp_current_user_can( 'bp_blogs_view_others_hidden_blogs' ) ) {
                         $hidden_sql = 'AND wb.public = 1';
                 }
 

src/bp-core/admin/bp-core-admin-functions.php

@@ -139 +139 @@
 function bp_core_print_admin_notices() {
 
         // Only the super admin should see messages.
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_core_view_admin_screens' ) ) {
                 return;
         }
 
@@ -228 +228 @@
         global $wpdb;
 
         // Only the super admin gets warnings.
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_core_view_admin_screens' ) ) {
                 return;
         }
 
@@ -1004 +1004 @@
         }
 
         // Prevent duplicate separators when no core menu items exist.
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_core_view_admin_screens' ) ) {
                 $add = false;
         }
 
@@ -1014 +1014 @@
         }
 
         // Force on Site Admin if BuddyPress Core post-types are registered
-        if ( is_blog_admin() && bp_current_user_can( 'bp_moderate' ) ) {
+        if ( is_blog_admin() && bp_current_user_can( 'bp_core_view_admin_screens' ) ) {
 
                 // See: BP_Core::register_post_types()
                 if ( post_type_exists( bp_get_email_post_type() ) || post_type_exists( 'buddypress' ) ) {
@@ -1053 +1053 @@
 function bp_admin_custom_menu_order( $menu_order = false ) {
 
         // Bail if user cannot see admin pages.
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_core_view_admin_screens' ) ) {
                 return $menu_order;
         }
 
@@ -1071 +1071 @@
 function bp_admin_menu_order( $menu_order = array() ) {
 
         // Bail if user cannot see admin pages.
-        if ( empty( $menu_order ) || ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( empty( $menu_order ) || ! bp_current_user_can( 'bp_core_view_admin_screens' ) ) {
                 return $menu_order;
         }
 

src/bp-core/bp-core-filters.php

@@ -1391 +1391 @@
         return $link;
 }
 add_filter( 'post_type_link', 'bp_get_post_type_link', 10, 2 );
+
+/**
+ * Filter the bp_user_can value to determine what the user can do
+ * with regards to the core component.
+ *
+ * @since 15.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_core_user_can_filter( $retval, $user_id, $capability, $site_id, $args ) {
+        switch ( $capability ) {
+                case 'bp_core_customize_emails':
+                case 'bp_core_manage_taxonomies':
+                case 'bp_core_view_others_profiles':
+                case 'bp_core_view_admin_screens':
+                        // Fall back to the bp_moderate capability.
+                        $retval = bp_user_can( $user_id, 'bp_moderate' );
+                        break;
+        }
+
+        return $retval;
+}
+add_filter( 'bp_user_can', 'bp_core_user_can_filter', 10, 5 );

src/bp-core/bp-core-functions.php

@@ -3387 +3387 @@
                 'rewrite'       => false,
                 'show_in_menu'  => false,
                 'show_tagcloud' => false,
-                'show_ui'       => bp_is_root_blog() && bp_current_user_can( 'bp_moderate' ),
+                'show_ui'       => bp_is_root_blog() && bp_current_user_can( 'bp_core_manage_taxonomies' ),
         );
 }
 

src/bp-core/bp-core-template.php

@@ -1444 +1444 @@
  * @return bool
  */
 function bp_user_has_access() {
-        $has_access = bp_current_user_can( 'bp_moderate' ) || bp_is_my_profile();
+        $has_access = bp_current_user_can( 'bp_core_view_others_profiles' ) || bp_is_my_profile();
 
         /**
          * Filters whether or not a user has access.

src/bp-core/classes/class-bp-admin-types.php

@@ -154 +154 @@
         private function handle_action( $action ) {
                 $referer = wp_get_referer();
 
-                if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! bp_current_user_can( 'bp_core_manage_taxonomies' ) ) {
                         return;
                 }
 

src/bp-core/classes/class-bp-core.php

@@ -389 +389 @@
                                                 'labels'             => bp_get_email_post_type_labels(),
                                                 'menu_icon'          => 'dashicons-email',
                                                 'public'             => false,
-                                                'publicly_queryable' => bp_current_user_can( 'bp_moderate' ),
+                                                'publicly_queryable' => bp_current_user_can( 'bp_core_customize_emails' ),
                                                 'query_var'          => false,
                                                 'rewrite'            => false,
                                                 'show_in_admin_bar'  => false,
-                                                'show_ui'            => bp_current_user_can( 'bp_moderate' ),
+                                                'show_ui'            => bp_current_user_can( 'bp_core_customize_emails' ),
                                                 'supports'           => bp_get_email_post_type_supports(),
                                         )
                                 )

src/bp-friends/bp-friends-filters.php

@@ -80 +80 @@
         return $exporters;
 }
 add_filter( 'wp_privacy_personal_data_exporters', 'bp_friends_register_personal_data_exporters' );
+
+/**
+ * Filter the bp_user_can value to determine what the user can do
+ * with regards to the friends component.
+ *
+ * @since 15.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_friends_user_can_filter( $retval, $user_id, $capability, $site_id, $args ) {
+        switch ( $capability ) {
+                case 'bp_friends_manage_others_friendships':
+                        // Fall back to the bp_moderate capability.
+                        $retval = bp_user_can( $user_id, 'bp_moderate' );
+                        break;
+        }
+
+        return $retval;
+}
+add_filter( 'bp_user_can', 'bp_friends_user_can_filter', 10, 5 );

src/bp-friends/classes/class-bp-friends-rest-controller.php

@@ -315 +315 @@
                         );
                 }
 
-                $is_moderator    = bp_current_user_can( 'bp_moderate' );
+                $is_moderator    = bp_current_user_can( 'bp_friends_manage_others_friendships' );
                 $current_user_id = bp_loggedin_user_id();
 
                 /**
-                 * - Only admins can create friendship requests for other people.
-                 * - Admins can't create friendship requests to themselves from other people.
+                 * - Only privileged users (usually admins) can create friendship requests for other people.
                  * - Users can't create friendship requests to themselves from other people.
                  */
                 if (

src/bp-groups/bp-groups-activity.php

@@ -583 +583 @@
         $content          = $r['content'];
         $user_id          = (int) $r['user_id'];
         $is_user_active   = bp_is_user_active( $user_id );
-        $is_group_allowed = $group_id && ( bp_current_user_can( 'bp_moderate' ) || groups_is_user_member( $user_id, $group_id ) );
+        $is_group_allowed = $group_id && ( bp_current_user_can( 'bp_groups_post_to_nonmember_group' ) || groups_is_user_member( $user_id, $group_id ) );
 
         if ( ! $content || ! strlen( trim( $content ) ) || ! $is_user_active || ! $is_group_allowed ) {
                 if ( 'wp_error' === $r['error_type'] ) {

src/bp-groups/bp-groups-admin.php

@@ -602 +602 @@
  */
 function bp_groups_admin_edit() {
 
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_groups_use_admin_edit_screen' ) ) {
                 die( '-1' );
         }
 
@@ -843 +843 @@
  */
 function bp_groups_admin_delete() {
 
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_groups_use_admin_edit_screen' ) ) {
                 die( '-1' );
         }
 
@@ -1336 +1336 @@
         check_admin_referer( 'bp-group-type-change-' . $group_id, 'bp-group-type-nonce' );
 
         // Permission check.
-        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_current_user_can( 'bp_groups_use_admin_edit_screen' ) ) {
                 return;
         }
 
@@ -1456 +1456 @@
 function bp_groups_admin_autocomplete_handler() {
 
         // Bail if user user shouldn't be here, or is a large network.
-        if ( ! bp_current_user_can( 'bp_moderate' ) || bp_is_large_install() ) {
+        if ( ! bp_current_user_can( 'bp_groups_use_admin_edit_screen' ) || bp_is_large_install() ) {
                 wp_die( -1 );
         }
 
@@ -1512 +1512 @@
         // Bail if nonce check fails.
         check_admin_referer( 'bp-bulk-groups-change-type-' . bp_loggedin_user_id(), 'bp-bulk-groups-change-type-nonce' );
 
-        if ( ! bp_current_user_can( 'bp_moderate' )  ) {
+        if ( ! bp_current_user_can( 'bp_groups_use_admin_edit_screen' )  ) {
                 return;
         }
 

src/bp-groups/bp-groups-adminbar.php

@@ -34 +34 @@
         }
 
         // Only show this menu to group admins and super admins.
-        if ( ! bp_current_user_can( 'bp_moderate' ) && ! bp_group_is_admin() ) {
+        if ( ! bp_current_user_can( 'bp_groups_manage_groups' ) && ! bp_group_is_admin() ) {
                 return false;
         }
 

src/bp-groups/bp-groups-filters.php

@@ -354 +354 @@
                                 $retval = true;
                         }
                         break;
+                case 'bp_groups_view_hidden_groups':
+                case 'bp_groups_post_to_nonmember_group':
+                case 'bp_groups_use_admin_edit_screen':
+                case 'bp_groups_manage_groups':
+                case 'bp_groups_is_item_admin':
+                case 'bp_groups_moderate_invitations':
+                case 'bp_groups_moderate_requests':
+                        // Fall back to the bp_moderate capability.
+                        $retval = bp_user_can( $user_id, 'bp_moderate' );
+                        break;
         }
 
         return $retval;

src/bp-groups/classes/class-bp-groups-component.php

@@ -298 +298 @@
                 array_shift( $bp->action_variables );
 
                 // Using "item" not "group" for generic support in other components.
-                if ( bp_current_user_can( 'bp_moderate' ) ) {
+                if ( bp_current_user_can( 'bp_groups_is_item_admin' ) ) {
                         bp_update_is_item_admin( true, 'groups' );
                 } else {
                         bp_update_is_item_admin( groups_is_user_admin( bp_loggedin_user_id(), $current_group->id ), 'groups' );

src/bp-groups/classes/class-bp-groups-group.php

@@ -1759 +1759 @@
          * Get a total group count for the site.
          *
          * Will include hidden groups in the count only if
-         * bp_current_user_can( 'bp_moderate' ).
+         * bp_current_user_can( 'bp_groups_view_hidden_groups' ).
          *
          * @since 1.6.0
          * @since 10.0.0 Added the `$skip_cache` parameter.
@@ -1778 +1778 @@
 
                 if ( false === $count || true === $skip_cache ) {
                         $hidden_sql = '';
-                        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+                        if ( ! bp_current_user_can( 'bp_groups_view_hidden_groups' ) ) {
                                 $hidden_sql = "WHERE status != 'hidden'";
                         }
 

src/bp-groups/classes/class-bp-groups-invites-rest-controller.php

@@ -135 +135 @@
                 }
 
                 // If the query is not restricted by group, user or inviter, limit it to the current user, if not an admin.
-                if ( ! $args['item_id'] && ! $args['user_id'] && ! $args['inviter_id'] && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! $args['item_id'] && ! $args['user_id'] && ! $args['inviter_id'] && ! bp_current_user_can( 'bp_groups_moderate_invitations' ) ) {
                         $args['user_id'] = bp_loggedin_user_id();
                 }
 
@@ -239 +239 @@
                                                                 'status' => 404,
                                                         )
                                                 );
-                                        } elseif ( bp_current_user_can( 'bp_moderate' ) || $this->can_see( $group->id ) ) {
+                                        } elseif ( bp_current_user_can( 'bp_groups_moderate_invitations' ) || $this->can_see( $group->id ) ) {
                                                 /*
                                                 * Users can see invitations if they
                                                 * - are a site admin,
@@ -262 +262 @@
                                                         'status' => 404,
                                                 )
                                         );
-                                } elseif ( bp_current_user_can( 'bp_moderate' ) || $user->ID === $current_user_id ) {
+                                } elseif ( bp_current_user_can( 'bp_groups_moderate_invitations' ) || $user->ID === $current_user_id ) {
                                         /*
                                         * Users can see invitations if they:
                                         * - are a site admin,
@@ -284 +284 @@
                                                         'status' => 404,
                                                 )
                                         );
-                                } elseif ( bp_current_user_can( 'bp_moderate' ) || $inviter->ID === $current_user_id ) {
+                                } elseif ( bp_current_user_can( 'bp_groups_moderate_invitations' ) || $inviter->ID === $current_user_id ) {
                                         /*
                                         * Users can see invitations if they:
                                         * - are a site admin,
@@ -374 +374 @@
                                                         'status' => 404,
                                                 )
                                         );
-                                } elseif ( bp_current_user_can( 'bp_moderate' ) || $this->can_see( $invite->item_id ) || in_array( $user_id, array( $invite->user_id, $invite->inviter_id ), true ) ) {
+                                } elseif ( bp_current_user_can( 'bp_groups_moderate_invitations' ) || $this->can_see( $invite->item_id ) || in_array( $user_id, array( $invite->user_id, $invite->inviter_id ), true ) ) {
                                         /*
                                         * Users can see a specific invitation if they
                                         * - are a site admin
@@ -510 +510 @@
                                                         'status' => 404,
                                                 )
                                         );
-                                } elseif ( bp_current_user_can( 'bp_moderate' ) || bp_loggedin_user_id() === $inviter_id_arg ) {
+                                } elseif ( bp_current_user_can( 'bp_groups_moderate_invitations' ) || bp_loggedin_user_id() === $inviter_id_arg ) {
                                                 $retval = true;
                                 } else {
                                         $retval = new WP_Error(
@@ -616 +616 @@
                                                 'status' => 404,
                                         )
                                 );
-                        } elseif ( bp_current_user_can( 'bp_moderate' ) || $user_id === $invite->user_id ) {
+                        } elseif ( bp_current_user_can( 'bp_groups_moderate_invitations' ) || $user_id === $invite->user_id ) {
                                 $retval = true;
                         } else {
                                 $retval = new WP_Error(
@@ -741 +741 @@
 
                 // The inviter, the invitee, group admins, and site admins can all delete invites.
                 if ( true === $retval
-                        && ! bp_current_user_can( 'bp_moderate' )
+                        && ! bp_current_user_can( 'bp_groups_moderate_invitations' )
                         && ! in_array( $user_id, array( $invite->user_id, $invite->inviter_id ), true )
                         && ! groups_is_user_admin( $user_id, $invite->item_id )
                         ) {

src/bp-groups/classes/class-bp-groups-member.php

@@ -725 +725 @@
                         $filter_sql        = $wpdb->prepare( " AND ( g.name LIKE %s OR g.description LIKE %s )", $search_terms_like, $search_terms_like );
                 }
 
-                if ( $user_id !== bp_loggedin_user_id() && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( $user_id !== bp_loggedin_user_id() && ! bp_current_user_can( 'bp_groups_view_hidden_groups' ) ) {
                         $hidden_sql = " AND g.status != 'hidden'";
                 }
 
@@ -746 +746 @@
         public static function total_group_count( $user_id = 0 ) {
                 global $wpdb;
 
-                if ( empty( $user_id ) )
+                if ( empty( $user_id ) ) {
                         $user_id = bp_displayed_user_id();
+                }
 
                 $bp = buddypress();
 
-                if ( $user_id != bp_loggedin_user_id() && !bp_current_user_can( 'bp_moderate' ) ) {
+                if ( (int) $user_id !== bp_loggedin_user_id() && ! bp_current_user_can( 'bp_groups_view_hidden_groups' ) ) {
                         return (int) $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(DISTINCT m.group_id) FROM {$bp->groups->table_name_members} m, {$bp->groups->table_name} g WHERE m.group_id = g.id AND g.status != 'hidden' AND m.user_id = %d AND m.is_confirmed = 1 AND m.is_banned = 0", $user_id ) );
                 } else {
                         return (int) $wpdb->get_var( $wpdb->prepare( "SELECT COUNT(DISTINCT m.group_id) FROM {$bp->groups->table_name_members} m, {$bp->groups->table_name} g WHERE m.group_id = g.id AND m.user_id = %d AND m.is_confirmed = 1 AND m.is_banned = 0", $user_id ) );

src/bp-groups/classes/class-bp-groups-membership-request-rest-controller.php

@@ -125 +125 @@
                 );
 
                 // If the query is not restricted by group or user, limit it to the current user, if not an admin.
-                if ( ! $args['item_id'] && ! $args['user_id'] && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! $args['item_id'] && ! $args['user_id'] && ! bp_current_user_can( 'bp_groups_moderate_requests' ) ) {
                         $args['user_id'] = bp_loggedin_user_id();
                 }
 
@@ -188 +188 @@
                         $group       = $this->groups_endpoint->get_group_object( $request->get_param( 'group_id' ) );
 
                         // If the query is not restricted by group or user, limit it to the current user, if not an admin.
-                        if ( ! $request->get_param( 'group_id' ) && ! $request->get_param( 'user_id' ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+                        if ( ! $request->get_param( 'group_id' ) && ! $request->get_param( 'user_id' ) && ! bp_current_user_can( 'bp_groups_moderate_requests' ) ) {
                                 $user_id_arg = $user_id;
                         }
                         $user = bp_rest_get_user( $user_id_arg );
@@ -218 +218 @@
                                         )
                                 );
                         } elseif (
-                                bp_current_user_can( 'bp_moderate' )
+                                bp_current_user_can( 'bp_groups_moderate_requests' )
                                 || ( $request->get_param( 'group_id' ) && groups_is_user_admin( $user_id, $request->get_param( 'group_id' ) ) )
                                 || $user_id_arg === $user_id
                         ) {
@@ -309 +309 @@
                                                 'status' => 404,
                                         )
                                 );
-                        } elseif ( bp_current_user_can( 'bp_moderate' ) || $user_id === $group_request->user_id || groups_is_user_admin( $user_id, $group_request->item_id ) ) {
+                        } elseif ( bp_current_user_can( 'bp_groups_moderate_requests' ) || $user_id === $group_request->user_id || groups_is_user_admin( $user_id, $group_request->item_id ) ) {
                                 $retval = true;
                         } else {
                                 $retval = new WP_Error(
@@ -435 +435 @@
                                 __( 'Invalid group ID.', 'buddypress' ),
                                 array( 'status' => 404 )
                         );
-                } elseif ( bp_current_user_can( 'bp_moderate' ) || $user_id === $user_id_arg ) {
+                } elseif ( bp_current_user_can( 'bp_groups_moderate_requests' ) || $user_id === $user_id_arg ) {
                         $retval = true;
                 } else {
                         $retval = new WP_Error(
@@ -532 +532 @@
                                         'status' => 404,
                                 )
                         );
-                } elseif ( bp_current_user_can( 'bp_moderate' ) || groups_is_user_admin( $user_id, $group_request->item_id ) ) {
+                } elseif ( bp_current_user_can( 'bp_groups_moderate_requests' ) || groups_is_user_admin( $user_id, $group_request->item_id ) ) {
                         $retval = true;
                 } else {
                         $retval = new WP_Error(
@@ -657 +657 @@
                                         'status' => 404,
                                 )
                         );
-                } elseif ( bp_current_user_can( 'bp_moderate' ) || $user_id === $group_request->user_id || groups_is_user_admin( $user_id, $group_request->item_id ) ) {
+                } elseif ( bp_current_user_can( 'bp_groups_moderate_requests' ) || $user_id === $group_request->user_id || groups_is_user_admin( $user_id, $group_request->item_id ) ) {
                         $retval = true;
                 } else {
                         $retval = new WP_Error(

src/bp-groups/classes/class-bp-groups-membership-rest-controller.php

@@ -192 +192 @@
                                                 'status' => 404,
                                         )
                                 );
-                        } elseif ( bp_current_user_can( 'bp_moderate' ) || 'public' === $group->status || groups_is_user_member( bp_loggedin_user_id(), $group->id ) ) {
+                        } elseif ( bp_current_user_can( 'bp_groups_view_hidden_groups' ) || 'public' === $group->status || groups_is_user_member( bp_loggedin_user_id(), $group->id ) ) {
                                 $retval = true;
                         }
                 }

src/bp-groups/classes/class-bp-groups-rest-controller.php

@@ -1060 +1060 @@
                 }
 
                 // Check for moderators or if user is a member of the group.
-                return ( bp_current_user_can( 'bp_moderate' ) || groups_is_user_member( bp_loggedin_user_id(), $group->id ) );
+                return ( bp_current_user_can( 'bp_groups_view_hidden_groups' ) || groups_is_user_member( bp_loggedin_user_id(), $group->id ) );
         }
 
         /**
@@ -1072 +1072 @@
          * @return bool
          */
         protected function can_see_hidden_groups( $request ) {
-                if ( bp_current_user_can( 'bp_moderate' ) ) {
+                if ( bp_current_user_can( 'bp_groups_view_hidden_groups' ) ) {
                         return true;
                 }
 

src/bp-groups/classes/class-bp-groups-template.php

@@ -198 +198 @@
                 $this->pag_page = bp_sanitize_pagination_arg( $this->pag_arg, $r['page']     );
                 $this->pag_num  = bp_sanitize_pagination_arg( 'num',          $r['per_page'] );
 
-                if ( bp_current_user_can( 'bp_moderate' ) || ( is_user_logged_in() && $user_id == bp_loggedin_user_id() ) ) {
+                if ( bp_current_user_can( 'bp_groups_view_hidden_groups' ) || ( is_user_logged_in() && $user_id == bp_loggedin_user_id() ) ) {
                         $show_hidden = true;
                 }
 

src/bp-groups/screens/single/admin/delete-group.php

@@ -18 +18 @@
                 return;
         }
 
-        if ( ! bp_is_item_admin() && ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_is_item_admin() && ! bp_current_user_can( 'bp_groups_manage_groups' ) ) {
                 return;
         }
 

src/bp-members/actions/delete-avatar.php

@@ -24 +24 @@
         // Check the nonce.
         check_admin_referer( 'bp_delete_avatar_link' );
 
-        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                 return false;
         }
 

src/bp-members/bp-members-filters.php

@@ -266 +266 @@
 
         switch ( $capability ) {
                 case 'bp_members_manage_membership_requests':
+                case 'bp_members_manage_members':
                         $retval = bp_user_can( $user_id, 'bp_moderate' );
                         break;
 

src/bp-members/bp-members-functions.php

@@ -1474 +1474 @@
                 $status = true;
         } elseif ( is_super_admin( bp_displayed_user_id() ) && ! is_super_admin() ) {
                 $status = false;
-        } elseif ( bp_current_user_can( 'bp_moderate' ) || current_user_can( 'edit_users' ) ) {
+        } elseif ( bp_current_user_can( 'bp_members_manage_members' ) || current_user_can( 'edit_users' ) ) {
                 $status = true;
         }
 

src/bp-members/bp-members-notifications.php

@@ -231 +231 @@
 function members_screen_notification_settings() {
 
         // Bail early if invitations and requests are not allowed--they are the only members notification so far.
-        if ( ! bp_get_members_invitations_allowed() && ( ! bp_get_membership_requests_required() || ! user_can( bp_displayed_user_id(), 'bp_moderate' ) ) ) {
+        if ( ! bp_get_members_invitations_allowed() && ( ! bp_get_membership_requests_required() || ! bp_user_can( bp_displayed_user_id(), 'bp_members_manage_membership_requests' ) ) ) {
                 return;
         }
         ?>
@@ -273 +273 @@
                                 <?php
                         endif;
 
-                        if ( bp_get_membership_requests_required() && user_can( bp_displayed_user_id(), 'bp_moderate' ) ) :
+                        if ( bp_get_membership_requests_required() && bp_user_can( bp_displayed_user_id(), 'bp_members_manage_membership_requests' ) ) :
                                 if ( ! $allow_request_emails = bp_get_user_meta( bp_displayed_user_id(), 'notification_members_membership_request', true ) ) {
                                         $allow_request_emails = 'yes';
                                 }

src/bp-members/classes/class-bp-members-admin.php

@@ -495 +495 @@
                 if ( $this->current_user_id === $user_id ) {
                         $retval = true;
 
-                // Trust the 'bp_moderate' capability.
+                // Trust the 'bp_members_manage_members' capability.
                 } else {
-                        $retval = ( bp_current_user_can( 'edit_users' ) || bp_current_user_can( 'bp_moderate' ) );
+                        $retval = ( bp_current_user_can( 'edit_users' ) || bp_current_user_can( 'bp_members_manage_members' ) );
                 }
 
                 return $retval;
@@ -1243 +1243 @@
          */
         public function user_admin() {
 
-                if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' ) && empty( $this->is_self_profile ) ) {
+                if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_members_manage_members' ) && empty( $this->is_self_profile ) ) {
                         die( '-1' );
                 }
 
@@ -1598 +1598 @@
                 $types        = bp_get_member_types( array(), 'objects' );
                 $current_type = (array) bp_get_member_type( $user->ID, false );
                 $types_count  = count( array_filter( $current_type ) );
-                $disabled     = ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' );
+                $disabled     = ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_members_manage_members' );
                 ?>
 
                 <label for="bp-members-profile-member-type" class="screen-reader-text">
@@ -1638 +1638 @@
                 check_admin_referer( 'bp-member-type-change-' . $user_id, 'bp-member-type-nonce' );
 
                 // Permission check.
-                if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                         return;
                 }
 
@@ -1694 +1694 @@
                 $args['wp_http_referer'] = urlencode( $wp_http_referer );
 
                 // Add the "Extended" link if the current user can edit this user.
-                if ( current_user_can( 'edit_user', $user->ID ) || bp_current_user_can( 'bp_moderate' ) ) {
+                if ( current_user_can( 'edit_user', $user->ID ) || bp_current_user_can( 'bp_members_manage_members' ) ) {
 
                         // Add query args and setup the Extended link.
                         $edit_profile      = add_query_arg( $args, $this->edit_profile_url );

src/bp-members/classes/class-bp-members-component.php

@@ -435 +435 @@
                         }
 
                         /*
-                         * If we're on a spammer's profile page, only users with the 'bp_moderate' cap
+                         * If we're on a spammer's profile page, only users with the 'bp_members_manage_members' cap
                          * can view subpages on the spammer's profile.
                          *
                          * users without the cap trying to access a spammer's subnav page will get
                          * redirected to the root of the spammer's profile page.  this occurs by
                          * by removing the component in the canonical stack.
                          */
-                        if ( bp_is_user_spammer( bp_displayed_user_id() ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+                        if ( bp_is_user_spammer( bp_displayed_user_id() ) && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                                 unset( $bp->canonical_stack['component'] );
                         }
                 }
@@ -846 +846 @@
 
                                 // If the member is marked as a spammer, 404 (unless logged-in user is a super admin).
                                 if ( bp_is_user_spammer( $member->ID ) ) {
-                                        if ( bp_current_user_can( 'bp_moderate' ) ) {
+                                        if ( bp_current_user_can( 'bp_members_manage_members' ) ) {
                                                 bp_core_add_message( __( 'This user has been marked as a spammer. Only site admins can view this profile.', 'buddypress' ), 'warning' );
                                         } else {
                                                 bp_do_404();

src/bp-members/classes/class-bp-members-rest-controller.php

@@ -287 +287 @@
                                         __( 'Sorry, you are not allowed to view members with the edit context.', 'buddypress' ),
                                         array( 'status' => rest_authorization_required_code() )
                                 );
-                        } elseif ( bp_current_user_can( 'bp_moderate' ) || ! bp_is_user_spammer( $user->ID ) ) {
+                        } elseif ( bp_current_user_can( 'bp_members_manage_members' ) || ! bp_is_user_spammer( $user->ID ) ) {
                                 $retval = true;
                         }
                 }
@@ -362 +362 @@
                         }
 
                         if ( get_current_user_id() === $user->ID ) {
-                                if ( $member_type_edit && ! bp_current_user_can( 'bp_moderate' ) ) {
+                                if ( $member_type_edit && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                                         $retval = $error;
                                 } else {
                                         $retval = parent::update_item_permissions_check( $request );

src/bp-members/screens/change-avatar.php

@@ -14 +14 @@
  */
 function bp_members_screen_change_avatar() {
         // Bail if not the correct screen.
-        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                 return;
         }
 

src/bp-members/screens/change-cover-image.php

@@ -14 +14 @@
  */
 function bp_members_screen_change_cover_image() {
         // Bail if not the correct screen.
-        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                 return false;
         }
 

src/bp-messages/actions/bulk-manage.php

@@ -40 +40 @@
 
         // Make sure the user has access to all notifications before managing them.
         foreach ( $messages as $message ) {
-                if ( ! messages_check_thread_access( $message ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! messages_check_thread_access( $message ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                         bp_core_add_message( __( 'There was a problem managing your messages.', 'buddypress' ), 'error' );
                         bp_core_redirect( $redirect );
                 }

src/bp-messages/actions/read.php

@@ -36 +36 @@
         }
 
         // Check access to the message and mark as read.
-        if ( messages_check_thread_access( $id ) || bp_current_user_can( 'bp_moderate' ) ) {
+        if ( messages_check_thread_access( $id ) || bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                 messages_mark_thread_read( $id );
                 bp_core_add_message( __( 'Message marked as read.', 'buddypress' ) );
         } else {

src/bp-messages/actions/unread.php

@@ -36 +36 @@
         }
 
         // Check access to the message and mark unread.
-        if ( messages_check_thread_access( $id ) || bp_current_user_can( 'bp_moderate' ) ) {
+        if ( messages_check_thread_access( $id ) || bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                 messages_mark_thread_unread( $id );
                 bp_core_add_message( __( 'Message marked unread.', 'buddypress' ) );
         } else {

src/bp-messages/actions/view.php

@@ -22 +22 @@
         // Get the thread ID from the action variable.
         $thread_id = (int) bp_action_variable( 0 );
 
-        if ( ! messages_is_valid_thread( $thread_id ) || ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_moderate' ) ) ) {
+        if ( ! messages_is_valid_thread( $thread_id ) || ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) ) {
                 return;
         }
 

src/bp-messages/bp-messages-filters.php

@@ -101 +101 @@
 function bp_messages_enforce_current_user( $args = array() ) {
 
         // Non-community moderators can only ever see their own messages.
-        if ( is_user_logged_in() && ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( is_user_logged_in() && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                 $_user_id = (int) bp_loggedin_user_id();
                 if ( $_user_id !== (int) $args['user_id'] ) {
                         $args['user_id'] = $_user_id;
@@ -154 +154 @@
 
         return $exporters;
 }
+
+/**
+ * Filter the bp_user_can value to determine what the user can do in the messages component.
+ *
+ * @since 8.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id    User ID.
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_messages_user_can_filter( $retval, $user_id, $capability, $site_id, $args = array() ) {
+        switch ( $capability ) {
+                case 'bp_messages_manage_member_messages':
+                        $retval = bp_user_can( $user_id, 'bp_moderate' );
+                        break;
+        }
+
+        return $retval;
+}
+add_filter( 'bp_user_can', 'bp_messages_user_can_filter', 10, 5 );
+ No newline at end of file

src/bp-messages/classes/class-bp-messages-rest-controller.php

@@ -201 +201 @@
                                                 'status' => 404,
                                         )
                                 );
-                        } elseif ( (int) bp_loggedin_user_id() === $user->ID || bp_current_user_can( 'bp_moderate' ) ) {
+                        } elseif ( (int) bp_loggedin_user_id() === $user->ID || bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                                 $retval = true;
                         } else {
                                 $retval = new WP_Error(
@@ -314 +314 @@
                                                 'status' => 404,
                                         )
                                 );
-                        } elseif ( bp_current_user_can( 'bp_moderate' ) || messages_check_thread_access( $id, $user_id ) ) {
+                        } elseif ( bp_current_user_can( 'bp_messages_manage_member_messages' ) || messages_check_thread_access( $id, $user_id ) ) {
                                 $retval = true;
                         }
                 }
@@ -412 +412 @@
 
                         // It's an existing thread.
                         if ( $thread_id ) {
-                                if ( bp_current_user_can( 'bp_moderate' ) || ( messages_is_valid_thread( $thread_id ) && messages_check_thread_access( $thread_id ) ) ) {
+                                if ( bp_current_user_can( 'bp_messages_manage_member_messages' ) || ( messages_is_valid_thread( $thread_id ) && messages_check_thread_access( $thread_id ) ) ) {
                                         $retval = true;
                                 }
                         } else {
@@ -492 +492 @@
                  */
                 $can_edit_item_meta = apply_filters(
                         'bp_rest_messages_can_edit_item_meta',
-                        bp_loggedin_user_id() === $updated_message->sender_id || bp_current_user_can( 'bp_moderate' ),
+                        bp_loggedin_user_id() === $updated_message->sender_id || bp_current_user_can( 'bp_messages_manage_member_messages' ),
                         $updated_message,
                         $request
                 );

src/bp-messages/screens/view.php

@@ -32 +32 @@
         }
 
         // No access.
-        if ( ( ! messages_check_thread_access( $thread_id ) || ! bp_is_my_profile() ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ( ! messages_check_thread_access( $thread_id ) || ! bp_is_my_profile() ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                 // If not logged in, prompt for login.
                 if ( ! is_user_logged_in() ) {
                         bp_core_no_access();

src/bp-templates/bp-legacy/buddypress-functions.php

@@ -1196 +1196 @@
         $comment = new BP_Activity_Activity( $_POST['id'] );
 
         // Check access.
-        if ( ! bp_current_user_can( 'bp_moderate' ) && $comment->user_id != bp_loggedin_user_id() ) {
+        if ( ! bp_current_user_can( 'bp_activity_manage_activity_items' ) && $comment->user_id != bp_loggedin_user_id() ) {
                 exit( '-1' );
         }
 
@@ -1728 +1728 @@
         $thread_id = (int) $_POST['thread_id'];
 
         // Cannot respond to a thread you're not already a recipient on.
-        if ( ! bp_current_user_can( 'bp_moderate' ) && ( ! messages_is_valid_thread( $thread_id ) || ! messages_check_thread_access( $thread_id ) ) ) {
+        if ( ! bp_current_user_can( 'bp_activity_manage_activity_items' ) && ( ! messages_is_valid_thread( $thread_id ) || ! messages_check_thread_access( $thread_id ) ) ) {
                 echo "-1<div id='message' class='error'><p>" . esc_html__( 'There was a problem sending that reply. Please try again.', 'buddypress' ) . '</p></div>';
                 die;
         }

src/bp-templates/bp-nouveau/includes/groups/functions.php

@@ -490 +490 @@
                 // Nonce check.
                 check_admin_referer( 'bp_nouveau_group_invites_settings' );
 
-                if ( bp_is_my_profile() || bp_current_user_can( 'bp_moderate' ) ) {
+                if ( bp_is_my_profile() || bp_current_user_can( 'bp_members_manage_members' ) ) {
                         if ( empty( $_POST['account-group-invites-preferences'] ) ) {
                                 bp_delete_user_meta( bp_displayed_user_id(), '_bp_nouveau_restrict_invites_to_friends' );
                         } else {

src/bp-templates/bp-nouveau/includes/messages/ajax.php

@@ -186 +186 @@
 
         $thread_id = (int) $_POST['thread_id'];
 
-        if ( ! bp_current_user_can( 'bp_moderate' ) && ( ! messages_is_valid_thread( $thread_id ) || ! messages_check_thread_access( $thread_id ) ) ) {
+        if ( ! bp_current_user_can( 'bp_messages_manage_member_messages' ) && ( ! messages_is_valid_thread( $thread_id ) || ! messages_check_thread_access( $thread_id ) ) ) {
                 wp_send_json_error( $response );
         }
 
@@ -439 +439 @@
         $thread_id  = (int) $_POST['id'];
         $message_id = (int) $_POST['message_id'];
 
-        if ( ! messages_is_valid_thread( $thread_id ) || ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_moderate' ) ) ) {
+        if ( ! messages_is_valid_thread( $thread_id ) || ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) ) {
                 wp_send_json_error();
         }
 
@@ -478 +478 @@
 
         $thread_id = (int) $_POST['id'];
 
-        if ( ! messages_is_valid_thread( $thread_id ) || ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_moderate' ) ) ) {
+        if ( ! messages_is_valid_thread( $thread_id ) || ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) ) {
                 wp_send_json_error();
         }
 
@@ -626 +626 @@
         $thread_ids = wp_parse_id_list( $_POST['id'] );
 
         foreach ( $thread_ids as $thread_id ) {
-                if ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                         wp_send_json_error( $response );
                 }
 
@@ -779 +779 @@
         }
 
         foreach ( $thread_ids as $thread_id ) {
-                if ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                         wp_send_json_error( $response );
                 }
 
@@ -865 +865 @@
         $thread_ids = wp_parse_id_list( $_POST['id'] );
 
         foreach ( $thread_ids as $thread_id ) {
-                if ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_moderate' ) ) {
+                if ( ! messages_check_thread_access( $thread_id ) && ! bp_current_user_can( 'bp_messages_manage_member_messages' ) ) {
                         wp_send_json_error( $response );
                 }
 

src/bp-xprofile/bp-xprofile-caps.php

@@ -50 +50 @@
                         }
 
                         // Friends don't let friends edit each other's visibility.
-                        if ( $profile_user_id != bp_displayed_user_id() && ! bp_current_user_can( 'bp_moderate' ) ) {
+                        if ( $profile_user_id != bp_displayed_user_id() && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                                 $caps[] = 'do_not_allow';
                                 break;
                         }

src/bp-xprofile/bp-xprofile-filters.php

@@ -776 +776 @@
         add_action( 'bp_locate_template', '_bp_xprofile_signup_check_backcompat', 10, 2 );
 }
 add_action( 'bp_core_screen_signup', '_bp_xprofile_signup_start_backcompat' );
+
+/**
+ * Filter the bp_user_can value to determine what the user can do in the messages component.
+ *
+ * @since 8.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id    User ID.
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_xprofile_user_can_filter( $retval, $user_id, $capability, $site_id, $args = array() ) {
+        switch ( $capability ) {
+                case 'bp_xprofile_create_field_groups':
+                case 'bp_xprofile_create_fields':
+                        $retval = bp_user_can( $user_id, 'bp_moderate' );
+                        break;
+        }
+
+        return $retval;
+}
+add_filter( 'bp_user_can', 'bp_xprofile_user_can_filter', 10, 5 );

src/bp-xprofile/bp-xprofile-functions.php

@@ -1306 +1306 @@
 
                 // Nothing's private when viewing your own profile, or when the
                 // current user is an admin.
-                if ( $displayed_user_id == $current_user_id || bp_current_user_can( 'bp_moderate' ) ) {
+                if ( $displayed_user_id == $current_user_id || bp_current_user_can( 'bp_members_manage_members' ) ) {
                         $hidden_levels = array();
 
                 // If the current user and displayed user are friends, show all.

src/bp-xprofile/bp-xprofile-template.php

@@ -50 +50 @@
         $hide_empty_fields_default = ( ! is_network_admin() && ! is_admin() && ! bp_is_user_profile_edit() && ! bp_is_register_page() );
 
         // We only need to fetch visibility levels when viewing your own profile.
-        if ( bp_is_my_profile() || bp_current_user_can( 'bp_moderate' ) || bp_is_register_page() ) {
+        if ( bp_is_my_profile() || bp_current_user_can( 'bp_members_manage_members' ) || bp_is_register_page() ) {
                 $fetch_visibility_level_default = true;
         } else {
                 $fetch_visibility_level_default = false;

src/bp-xprofile/classes/class-bp-xprofile-data-rest-controller.php

@@ -509 +509 @@
          * @return bool
          */
         protected function can_see( $field_user_id ) {
-                return ( bp_current_user_can( 'bp_moderate' ) || bp_loggedin_user_id() === $field_user_id );
+                return ( bp_current_user_can( 'bp_members_manage_members' ) || bp_loggedin_user_id() === $field_user_id );
         }
 
         /**

src/bp-xprofile/classes/class-bp-xprofile-field-groups-rest-controller.php

@@ -404 +404 @@
                         )
                 );
 
-                if ( is_user_logged_in() && bp_current_user_can( 'bp_moderate' ) ) {
+                if ( is_user_logged_in() && bp_current_user_can( 'bp_xprofile_create_field_groups' ) ) {
                         $retval = true;
                 }
 

src/bp-xprofile/classes/class-bp-xprofile-field-type.php

@@ -546 +546 @@
                         $r['aria-required'] = 'true';
 
                         // Moderators can bypass field requirements.
-                        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
+                        if ( ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                                 $r[] = 'required';
                         }
                 }

src/bp-xprofile/classes/class-bp-xprofile-fields-rest-controller.php

@@ -445 +445 @@
                         )
                 );
 
-                if ( is_user_logged_in() && bp_current_user_can( 'bp_moderate' ) ) {
+                if ( is_user_logged_in() && bp_current_user_can( 'bp_xprofile_create_fields' ) ) {
                         $retval = true;
                 }
 

src/bp-xprofile/classes/class-bp-xprofile-user-admin.php

@@ -172 +172 @@
                         foreach ( (array) $posted_field_ids as $field_id ) {
                                 bp_xprofile_maybe_format_datebox_post_data( $field_id );
 
-                                $is_required[ $field_id ] = xprofile_check_is_required_field( $field_id ) && ! bp_current_user_can( 'bp_moderate' );
+                                $is_required[ $field_id ] = xprofile_check_is_required_field( $field_id ) && ! bp_current_user_can( 'bp_members_manage_members' );
                                 if ( $is_required[ $field_id ] && empty( $_POST[ 'field_' . $field_id ] ) ) {
                                         $redirect_to = add_query_arg( 'error', '2', $redirect_to );
                                         bp_core_redirect( $redirect_to );
@@ -276 +276 @@
                                 'profile_group_id'       => 0,
                                 'user_id'                => $user->ID,
                                 'hide_field_types'       => array( 'wp-textbox', 'wp-biography' ),
-                                'fetch_visibility_level' => bp_current_user_can( 'bp_moderate' ) || (int) get_current_user_id() === (int) $user->ID,
+                                'fetch_visibility_level' => bp_current_user_can( 'bp_members_manage_members' ) || (int) get_current_user_id() === (int) $user->ID,
                         ),
                         'bp_xprofile_user_admin_profile_loop_args'
                 );

src/bp-xprofile/screens/edit.php

@@ -15 +15 @@
  */
 function xprofile_screen_edit_profile() {
 
-        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_moderate' ) ) {
+        if ( ! bp_is_my_profile() && ! bp_current_user_can( 'bp_members_manage_members' ) ) {
                 return;
         }
 
@@ -60 +60 @@
                 foreach ( (array) $posted_field_ids as $field_id ) {
                         bp_xprofile_maybe_format_datebox_post_data( $field_id );
 
-                        $is_required[ $field_id ] = xprofile_check_is_required_field( $field_id ) && ! bp_current_user_can( 'bp_moderate' );
+                        $is_required[ $field_id ] = xprofile_check_is_required_field( $field_id ) && ! bp_current_user_can( 'bp_members_manage_members' );
                         if ( $is_required[ $field_id ] && empty( $_POST[ 'field_' . $field_id ] ) ) {
                                 $errors = true;
                         }