Changeset 11776

Timestamp:

12/14/2017 01:24:01 PM (9 years ago)

Author:

dcavins

Message:

Use bp_user_can for group-related permissions.

Centralize and de-duplicate permissions checks for group-related functions, like checking whether a user can join a group or send invitations from a group.

Props dcavins, djpaul.

Fixes #7610.

Location:

trunk

Files:

• src/bp-groups/bp-groups-actions.php (modified) (1 diff)
• src/bp-groups/bp-groups-filters.php (modified) (2 diffs)
• src/bp-groups/bp-groups-template.php (modified) (1 diff)
• src/bp-groups/classes/class-bp-groups-component.php (modified) (1 diff)
• src/bp-templates/bp-legacy/buddypress-functions.php (modified) (3 diffs)
• tests/phpunit/testcases/groups/user_can.php (added)

trunk/src/bp-groups/bp-groups-actions.php

@@ -421 +421 @@
 
                 // User wants to join a group that is not public.
-                if ( $bp->groups->current_group->status != 'public' ) {
+                if ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $bp->groups->current_group->id ) ) ) {
                         if ( !groups_check_user_has_invite( bp_loggedin_user_id(), $bp->groups->current_group->id ) ) {
                                 bp_core_add_message( __( 'There was an error joining the group.', 'buddypress' ), 'error' );

trunk/src/bp-groups/bp-groups-filters.php

@@ -159 +159 @@
         }
 
-        if ( 'groups' === $activity->component ) {
-                $group = groups_get_group( $activity->item_id );
-                if ( 'public' !== $group->status && ! groups_is_user_member( $user_id, $group->id ) ) {
-                        $send = false;
-                }
+        if ( 'groups' === $activity->component && ! bp_user_can( $user_id, 'groups_access_group', array( 'group_id' => $activity->item_id ) ) ) {
+                $send = false;
         }
 
@@ -191 +188 @@
         return $avatar;
 }
+
+/**
+ * Filter the bp_user_can value to determine what the user can do
+ * with regards to a specific group.
+ *
+ * @since 3.0.0
+ *
+ * @param bool   $retval     Whether or not the current user has the capability.
+ * @param int    $user_id
+ * @param string $capability The capability being checked for.
+ * @param int    $site_id    Site ID. Defaults to the BP root blog.
+ * @param array  $args       Array of extra arguments passed.
+ *
+ * @return bool
+ */
+function bp_groups_user_can_filter( $retval, $user_id, $capability, $site_id, $args ) {
+        if ( empty( $args['group_id'] ) ) {
+                $group_id = bp_get_current_group_id();
+        } else {
+                $group_id = (int) $args['group_id'];
+        }
+
+        switch ( $capability ) {
+                case 'groups_join_group':
+                        // Return early if the user isn't logged in or the group ID is unknown.
+                        if ( ! $user_id || ! $group_id ) {
+                                break;
+                        }
+
+                        // The group must allow joining, and the user should not currently be a member.
+                        $group = groups_get_group( $group_id );
+                        if ( 'public' === bp_get_group_status( $group )
+                                && ! groups_is_user_member( $user_id, $group->id )
+                                && ! groups_is_user_banned( $user_id, $group->id )
+                        ) {
+                                $retval = true;
+                        }
+                        break;
+
+                case 'groups_request_membership':
+                        // Return early if the user isn't logged in or the group ID is unknown.
+                        if ( ! $user_id || ! $group_id ) {
+                                break;
+                        }
+
+                        /*
+                        * The group must accept membership requests, and the user should not
+                        * currently be a member, have an active request, or be banned.
+                        */
+                        $group = groups_get_group( $group_id );
+                        if ( 'private' === bp_get_group_status( $group )
+                                && ! groups_is_user_member( $user_id, $group->id )
+                                && ! groups_check_for_membership_request( $user_id, $group->id )
+                                && ! groups_is_user_banned( $user_id, $group->id )
+                        ) {
+                                $retval = true;
+                        }
+                        break;
+
+                case 'groups_send_invitation':
+                        // Return early if the user isn't logged in or the group ID is unknown.
+                        if ( ! $user_id || ! $group_id ) {
+                                break;
+                        }
+
+                        /*
+                        * The group must allow invitations, and the user should not
+                        * currently be a member or be banned from the group.
+                        */
+                        $group = groups_get_group( $group_id );
+                        // Users with the 'bp_moderate' cap can always send invitations.
+                        if ( bp_user_can( $user_id, 'bp_moderate' ) ) {
+                                $retval = true;
+                        } else {
+                                $invite_status = bp_group_get_invite_status( $group_id );
+
+                                switch ( $invite_status ) {
+                                        case 'admins' :
+                                                if ( groups_is_user_admin( $user_id, $group_id ) ) {
+                                                        $retval = true;
+                                                }
+                                                break;
+
+                                        case 'mods' :
+                                                if ( groups_is_user_mod( $user_id, $group_id ) || groups_is_user_admin( $user_id, $group_id ) ) {
+                                                        $retval = true;
+                                                }
+                                                break;
+
+                                        case 'members' :
+                                                if ( groups_is_user_member( $user_id, $group_id ) ) {
+                                                        $retval = true;
+                                                }
+                                                break;
+                                }
+                        }
+                        break;
+
+                case 'groups_receive_invitation':
+                        // Return early if the user isn't logged in or the group ID is unknown.
+                        if ( ! $user_id || ! $group_id ) {
+                                break;
+                        }
+
+                        /*
+                        * The group must allow invitations, and the user should not
+                        * currently be a member or be banned from the group.
+                        */
+                        $group = groups_get_group( $group_id );
+                        if ( in_array( bp_get_group_status( $group ), array( 'private', 'hidden' ), true )
+                                && ! groups_is_user_member( $user_id, $group->id )
+                                && ! groups_is_user_banned( $user_id, $group->id )
+                        ) {
+                                $retval = true;
+                        }
+                        break;
+
+                case 'groups_access_group':
+                        // Return early if the group ID is unknown.
+                        if ( ! $group_id ) {
+                                break;
+                        }
+
+                        $group = groups_get_group( $group_id );
+
+                        // If the check is for the logged-in user, use the BP_Groups_Group property.
+                        if ( $user_id === bp_loggedin_user_id() ) {
+                                $retval = $group->user_has_access;
+
+                        /*
+                         * If the check is for a specified user who is not the logged-in user
+                         * run the check manually.
+                         */
+                        } elseif ( 'public' === bp_get_group_status( $group ) || groups_is_user_member( $user_id, $group->id ) ) {
+                                $retval = true;
+                        }
+                        break;
+
+                case 'groups_see_group':
+                        // Return early if the group ID is unknown.
+                        if ( ! $group_id ) {
+                                break;
+                        }
+
+                        $group = groups_get_group( $group_id );
+
+                        // If the check is for the logged-in user, use the BP_Groups_Group property.
+                        if ( $user_id === bp_loggedin_user_id() ) {
+                                $retval = $group->is_visible;
+
+                        /*
+                         * If the check is for a specified user who is not the logged-in user
+                         * run the check manually.
+                         */
+                        } elseif ( 'hidden' !== bp_get_group_status( $group ) || groups_is_user_member( $user_id, $group->id ) ) {
+                                $retval = true;
+                        }
+                        break;
+        }
+
+        return $retval;
+
+}
+add_filter( 'bp_user_can', 'bp_groups_user_can_filter', 10, 5 );

trunk/src/bp-groups/bp-groups-template.php

@@ -2186 +2186 @@
 
         if ( $user_id ) {
-                // Users with the 'bp_moderate' cap can always send invitations.
-                if ( bp_user_can( $user_id, 'bp_moderate' ) ) {
-                        $can_send_invites = true;
-                } else {
-                        $invite_status = bp_group_get_invite_status( $group_id );
-
-                        switch ( $invite_status ) {
-                                case 'admins' :
-                                        if ( groups_is_user_admin( $user_id, $group_id ) ) {
-                                                $can_send_invites = true;
-                                        }
-                                        break;
-
-                                case 'mods' :
-                                        if ( groups_is_user_mod( $user_id, $group_id ) || groups_is_user_admin( $user_id, $group_id ) ) {
-                                                $can_send_invites = true;
-                                        }
-                                        break;
-
-                                case 'members' :
-                                        if ( groups_is_user_member( $user_id, $group_id ) ) {
-                                                $can_send_invites = true;
-                                        }
-                                        break;
-                        }
-                }
+                $can_send_invites = bp_user_can( $user_id, 'groups_send_invitation', array( 'group_id' => $group_id ) );
         }
 

trunk/src/bp-groups/classes/class-bp-groups-component.php

@@ -544 +544 @@
                         // member and does not have an outstanding invitation,
                         // show a "Request Membership" nav item.
-                        if ( is_user_logged_in() &&
-                                 ! $this->current_group->is_member &&
-                                 ! groups_check_for_membership_request( bp_loggedin_user_id(), $this->current_group->id ) &&
-                                 $this->current_group->status == 'private' &&
-                                 ! groups_check_user_has_invite( bp_loggedin_user_id(), $this->current_group->id )
-                                ) {
+                        if ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $this->current_group->id ) ) ) {
 
                                 $sub_nav[] = array(

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -1493 +1493 @@
 
         if ( ! groups_is_user_member( bp_loggedin_user_id(), $group->id ) ) {
-                if ( 'public' == $group->status ) {
+                if ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $group->id ) ) ) {
                         check_ajax_referer( 'groups_join_group' );
 
@@ -1502 +1502 @@
                         }
 
-                } elseif ( 'private' == $group->status ) {
+                } elseif ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $group->id ) ) ) {
 
                         // If the user has already been invited, then this is
@@ -1532 +1532 @@
                 if ( ! groups_leave_group( $group->id ) ) {
                         _e( 'Error leaving group', 'buddypress' );
-                } elseif ( 'public' == $group->status ) {
+                } elseif ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $group->id ) ) ) {
                         echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button join-group" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'join', 'groups_join_group' ) . '">' . __( 'Join Group', 'buddypress' ) . '</a>';
-                } elseif ( 'private' == $group->status ) {
+                } elseif ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $group->id ) ) ) {
                         echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button request-membership" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'request-membership', 'groups_request_membership' ) . '">' . __( 'Request Membership', 'buddypress' ) . '</a>';
                 }