Changeset 11776

Timestamp:

12/14/2017 01:24:01 PM (7 years ago)

Author:

dcavins

Message:

Use bp_user_can for group-related permissions.

Centralize and de-duplicate permissions checks for group-related functions, like checking whether a user can join a group or send invitations from a group.

Props dcavins, djpaul.

Fixes #7610.

Location:

trunk

Files:

• src/bp-groups/bp-groups-actions.php (modified) (1 diff)
• src/bp-groups/bp-groups-filters.php (modified) (2 diffs)
• src/bp-groups/bp-groups-template.php (modified) (1 diff)
• src/bp-groups/classes/class-bp-groups-component.php (modified) (1 diff)
• src/bp-templates/bp-legacy/buddypress-functions.php (modified) (3 diffs)
• tests/phpunit/testcases/groups/user_can.php (added)

trunk/src/bp-groups/bp-groups-actions.php

@@ -421 +421 @@
 
         // User wants to join a group that is not public.
-        if ( $bp->groups->current_group->status != 'public' ) {
+        if ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $bp->groups->current_group->id ) ) ) {
             if ( !groups_check_user_has_invite( bp_loggedin_user_id(), $bp->groups->current_group->id ) ) {
                 bp_core_add_message( __( 'There was an error joining the group.', 'buddypress' ), 'error' );

trunk/src/bp-groups/bp-groups-filters.php

@@ -159 +159 @@
     }
 
-    if ( 'groups' === $activity->component ) {
-        $group = groups_get_group( $activity->item_id );
-        if ( 'public' !== $group->status && ! groups_is_user_member( $user_id, $group->id ) ) {
-            $send = false;
-        }
+    if ( 'groups' === $activity->component && ! bp_user_can( $user_id, 'groups_access_group', array( 'group_id' => $activity->item_id ) ) ) {
+        $send = false;
     }
 
@@ -191 +188 @@
     return $avatar;
 }
+
+/**
+ * Filter the bp_user_can value to determine what the user can do
+ * with regards to a specific group.
+ *
+ * @since 3.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_groups_user_can_filter( $retval, $user_id, $capability, $site_id, $args ) {
+    if ( empty( $args['group_id'] ) ) {
+        $group_id = bp_get_current_group_id();
+    } else {
+        $group_id = (int) $args['group_id'];
+    }
+
+    switch ( $capability ) {
+        case 'groups_join_group':
+            // Return early if the user isn't logged in or the group ID is unknown.
+            if ( ! $user_id || ! $group_id ) {
+                break;
+            }
+
+            // The group must allow joining, and the user should not currently be a member.
+            $group = groups_get_group( $group_id );
+            if ( 'public' === bp_get_group_status( $group )
+                && ! groups_is_user_member( $user_id, $group->id )
+                && ! groups_is_user_banned( $user_id, $group->id )
+            ) {
+                $retval = true;
+            }
+            break;
+
+        case 'groups_request_membership':
+            // Return early if the user isn't logged in or the group ID is unknown.
+            if ( ! $user_id || ! $group_id ) {
+                break;
+            }
+
+            /*
+            * The group must accept membership requests, and the user should not
+            * currently be a member, have an active request, or be banned.
+            */
+            $group = groups_get_group( $group_id );
+            if ( 'private' === bp_get_group_status( $group )
+                && ! groups_is_user_member( $user_id, $group->id )
+                && ! groups_check_for_membership_request( $user_id, $group->id )
+                && ! groups_is_user_banned( $user_id, $group->id )
+            ) {
+                $retval = true;
+            }
+            break;
+
+        case 'groups_send_invitation':
+            // Return early if the user isn't logged in or the group ID is unknown.
+            if ( ! $user_id || ! $group_id ) {
+                break;
+            }
+
+            /*
+            * The group must allow invitations, and the user should not
+            * currently be a member or be banned from the group.
+            */
+            $group = groups_get_group( $group_id );
+            // Users with the 'bp_moderate' cap can always send invitations.
+            if ( bp_user_can( $user_id, 'bp_moderate' ) ) {
+                $retval = true;
+            } else {
+                $invite_status = bp_group_get_invite_status( $group_id );
+
+                switch ( $invite_status ) {
+                    case 'admins' :
+                        if ( groups_is_user_admin( $user_id, $group_id ) ) {
+                            $retval = true;
+                        }
+                        break;
+
+                    case 'mods' :
+                        if ( groups_is_user_mod( $user_id, $group_id ) || groups_is_user_admin( $user_id, $group_id ) ) {
+                            $retval = true;
+                        }
+                        break;
+
+                    case 'members' :
+                        if ( groups_is_user_member( $user_id, $group_id ) ) {
+                            $retval = true;
+                        }
+                        break;
+                }
+            }
+            break;
+
+        case 'groups_receive_invitation':
+            // Return early if the user isn't logged in or the group ID is unknown.
+            if ( ! $user_id || ! $group_id ) {
+                break;
+            }
+
+            /*
+            * The group must allow invitations, and the user should not
+            * currently be a member or be banned from the group.
+            */
+            $group = groups_get_group( $group_id );
+            if ( in_array( bp_get_group_status( $group ), array( 'private', 'hidden' ), true )
+                && ! groups_is_user_member( $user_id, $group->id )
+                && ! groups_is_user_banned( $user_id, $group->id )
+            ) {
+                $retval = true;
+            }
+            break;
+
+        case 'groups_access_group':
+            // Return early if the group ID is unknown.
+            if ( ! $group_id ) {
+                break;
+            }
+
+            $group = groups_get_group( $group_id );
+
+            // If the check is for the logged-in user, use the BP_Groups_Group property.
+            if ( $user_id === bp_loggedin_user_id() ) {
+                $retval = $group->user_has_access;
+
+            /*
+             * If the check is for a specified user who is not the logged-in user
+             * run the check manually.
+             */
+            } elseif ( 'public' === bp_get_group_status( $group ) || groups_is_user_member( $user_id, $group->id ) ) {
+                $retval = true;
+            }
+            break;
+
+        case 'groups_see_group':
+            // Return early if the group ID is unknown.
+            if ( ! $group_id ) {
+                break;
+            }
+
+            $group = groups_get_group( $group_id );
+
+            // If the check is for the logged-in user, use the BP_Groups_Group property.
+            if ( $user_id === bp_loggedin_user_id() ) {
+                $retval = $group->is_visible;
+
+            /*
+             * If the check is for a specified user who is not the logged-in user
+             * run the check manually.
+             */
+            } elseif ( 'hidden' !== bp_get_group_status( $group ) || groups_is_user_member( $user_id, $group->id ) ) {
+                $retval = true;
+            }
+            break;
+    }
+
+    return $retval;
+
+}
+add_filter( 'bp_user_can', 'bp_groups_user_can_filter', 10, 5 );

trunk/src/bp-groups/bp-groups-template.php

@@ -2186 +2186 @@
 
     if ( $user_id ) {
-        // Users with the 'bp_moderate' cap can always send invitations.
-        if ( bp_user_can( $user_id, 'bp_moderate' ) ) {
-            $can_send_invites = true;
-        } else {
-            $invite_status = bp_group_get_invite_status( $group_id );
-
-            switch ( $invite_status ) {
-                case 'admins' :
-                    if ( groups_is_user_admin( $user_id, $group_id ) ) {
-                        $can_send_invites = true;
-                    }
-                    break;
-
-                case 'mods' :
-                    if ( groups_is_user_mod( $user_id, $group_id ) || groups_is_user_admin( $user_id, $group_id ) ) {
-                        $can_send_invites = true;
-                    }
-                    break;
-
-                case 'members' :
-                    if ( groups_is_user_member( $user_id, $group_id ) ) {
-                        $can_send_invites = true;
-                    }
-                    break;
-            }
-        }
+        $can_send_invites = bp_user_can( $user_id, 'groups_send_invitation', array( 'group_id' => $group_id ) );
     }
 

trunk/src/bp-groups/classes/class-bp-groups-component.php

@@ -544 +544 @@
             // member and does not have an outstanding invitation,
             // show a "Request Membership" nav item.
-            if ( is_user_logged_in() &&
-                 ! $this->current_group->is_member &&
-                 ! groups_check_for_membership_request( bp_loggedin_user_id(), $this->current_group->id ) &&
-                 $this->current_group->status == 'private' &&
-                 ! groups_check_user_has_invite( bp_loggedin_user_id(), $this->current_group->id )
-                ) {
+            if ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $this->current_group->id ) ) ) {
 
                 $sub_nav[] = array(

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -1493 +1493 @@
 
     if ( ! groups_is_user_member( bp_loggedin_user_id(), $group->id ) ) {
-        if ( 'public' == $group->status ) {
+        if ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $group->id ) ) ) {
             check_ajax_referer( 'groups_join_group' );
 
@@ -1502 +1502 @@
             }
 
-        } elseif ( 'private' == $group->status ) {
+        } elseif ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $group->id ) ) ) {
 
             // If the user has already been invited, then this is
@@ -1532 +1532 @@
         if ( ! groups_leave_group( $group->id ) ) {
             _e( 'Error leaving group', 'buddypress' );
-        } elseif ( 'public' == $group->status ) {
+        } elseif ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $group->id ) ) ) {
             echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button join-group" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'join', 'groups_join_group' ) . '">' . __( 'Join Group', 'buddypress' ) . '</a>';
-        } elseif ( 'private' == $group->status ) {
+        } elseif ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $group->id ) ) ) {
             echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button request-membership" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'request-membership', 'groups_request_membership' ) . '">' . __( 'Request Membership', 'buddypress' ) . '</a>';
         }