Changeset 11302

Timestamp:

12/16/2016 09:43:59 AM (8 years ago)

Author:

hnla

Message:

Xprofile: profile field visibility levels, 'enforce field visibility'

Corrects an issue where logged out users are allowed to change profile field visibility level for registration despite admin disabling setting, introduced in 2.7.1 (r: 11221) which fixed inability to change profile visibility by user but omitted check for admin enforced levels.

Add checks for $field->allow_custom_visibility to logged out user caps check in bp-xprofile-caps.php

Fixes #7391 ( for 2.7 branch )

Props maccast, boonebgorges, slaFFik, hnla

File:

• branches/2.7/src/bp-xprofile/bp-xprofile-caps.php (modified) (1 diff)

branches/2.7/src/bp-xprofile/bp-xprofile-caps.php

@@ -79 +79 @@
 function bp_xprofile_grant_bp_xprofile_change_field_visibility_for_logged_out_users( $user_can, $user_id, $capability ) {
     if ( 'bp_xprofile_change_field_visibility' === $capability && 0 === $user_id ) {
-        $user_can = true;
+        $field_id = bp_get_the_profile_field_id();
+        if ( $field_id && $field = xprofile_get_field( $field_id ) ) {
+            $user_can = 'allowed' === $field->allow_custom_visibility;
+        }
     }