Changeset 11301

Timestamp:

12/16/2016 09:36:01 AM (8 years ago)

Author:

hnla

Message:

Xprofile: profile field visibility levels, 'enforce field visibility'

Corrects an issue where logged out users are allowed to change profile field visibility level for registration despite admin disabling setting, introduced in 2.7.1 (r: 11221) which fixed inability to change profile visibility by user but omitted check for admin enforced levels.

Add checks for $field->allow_custom_visibility to logged out user caps check in bp-xprofile-caps.php

Fixes #7391

Props maccast, boonebgorges, slaFFik, hnla

File:

• trunk/src/bp-xprofile/bp-xprofile-caps.php (modified) (1 diff)

trunk/src/bp-xprofile/bp-xprofile-caps.php

@@ -85 +85 @@
 function bp_xprofile_grant_bp_xprofile_change_field_visibility_for_logged_out_users( $user_can, $user_id, $capability ) {
     if ( 'bp_xprofile_change_field_visibility' === $capability && 0 === $user_id ) {
-        $user_can = true;
+        $field_id = bp_get_the_profile_field_id();
+        if ( $field_id && $field = xprofile_get_field( $field_id ) ) {
+            $user_can = 'allowed' === $field->allow_custom_visibility;
+        }
     }