Changeset 10232

Timestamp:

10/10/2015 04:13:02 PM (9 years ago)

Author:

djpaul

Message:

xprofile: remove is_admin() logic from required field check

The function should return the same thing for everyone, as it’s a
property of the field only (not the field-user combo). In the relevant
places where these functions are used in BP - namely, during form
submission - bp_moderate users are able to bypass the requirement.

This change breaks backwards compatibility in cases where the
field_is_required() functions are called directly, and the plugin
expects the function to return true for bp_moderate users. This is
unlikely, and given that if there were, they’d run into this same bug,
let’s fix it.

Fixes #6520

Props boonebgorges

Location:

trunk/src

Files:

• bp-members/bp-members-screens.php (modified) (1 diff)
• bp-xprofile/bp-xprofile-admin.php (modified) (1 diff)
• bp-xprofile/bp-xprofile-functions.php (modified) (1 diff)
• bp-xprofile/bp-xprofile-screens.php (modified) (1 diff)
• bp-xprofile/bp-xprofile-template.php (modified) (1 diff)

trunk/src/bp-members/bp-members-screens.php

@@ -144 +144 @@
 
                     // Create errors for required fields without values
-                    if ( xprofile_check_is_required_field( $field_id ) && empty( $_POST['field_' . $field_id] ) )
+                    if ( xprofile_check_is_required_field( $field_id ) && empty( $_POST[ 'field_' . $field_id ] ) && ! bp_current_user_can( 'bp_moderate' ) )
                         $bp->signup->errors['field_' . $field_id] = __( 'This is a required field', 'buddypress' );
                 }

trunk/src/bp-xprofile/bp-xprofile-admin.php

@@ -888 +888 @@
                 }
 
-                $is_required[ $field_id ] = xprofile_check_is_required_field( $field_id );
+                $is_required[ $field_id ] = xprofile_check_is_required_field( $field_id ) && ! bp_current_user_can( 'bp_moderate' );
                 if ( $is_required[ $field_id ] && empty( $_POST['field_' . $field_id ] ) ) {
                     $redirect_to = add_query_arg( 'error', '2', $redirect_to );

trunk/src/bp-xprofile/bp-xprofile-functions.php

@@ -541 +541 @@
 
 function xprofile_check_is_required_field( $field_id ) {
-    $field = new BP_Xprofile_Field( $field_id );
-
-    // Define locale variable(s).
+    $field  = new BP_Xprofile_Field( $field_id );
     $retval = false;
 
-    // Super admins can skip required check.
-    if ( bp_current_user_can( 'bp_moderate' ) && ! is_admin() ) {
-        $retval = false;
-
-    // All other users will use the field's setting.
-    } elseif ( isset( $field->is_required ) ) {
+    if ( isset( $field->is_required ) ) {
         $retval = $field->is_required;
     }

trunk/src/bp-xprofile/bp-xprofile-screens.php

@@ -99 +99 @@
             }
 
-            $is_required[$field_id] = xprofile_check_is_required_field( $field_id );
+            $is_required[ $field_id ] = xprofile_check_is_required_field( $field_id ) && ! bp_current_user_can( 'bp_moderate' );
             if ( $is_required[$field_id] && empty( $_POST['field_' . $field_id] ) ) {
                 $errors = true;

trunk/src/bp-xprofile/bp-xprofile-template.php

@@ -836 +836 @@
         global $field;
 
-        // Define locale variable(s).
         $retval = false;
 
-        // Super admins can skip required check.
-        if ( bp_current_user_can( 'bp_moderate' ) && !is_admin() ) {
-            $retval = false;
-
-        // All other users will use the field's setting.
-        } elseif ( isset( $field->is_required ) ) {
+        if ( isset( $field->is_required ) ) {
             $retval = $field->is_required;
         }