Changeset 11881

Timestamp:

03/04/2018 09:13:24 PM (9 years ago)

Author:

r-a-y

Message:

Activity: After r11806, fix read access checks to private activity items.

Previously, after r11806, anyone could access private activity items.

The problem is passing the displayed user ID instead of the current user
ID in bp_activity_user_can_read().

Commit also fixes an issue with the login URL redirect for logged-out users.

Fixes #7048.

File:

• trunk/src/bp-activity/bp-activity-screens.php (modified) (3 diffs)

trunk/src/bp-activity/bp-activity-screens.php

@@ -225 +225 @@
         }
 
-        $user_id = bp_displayed_user_id();
-
         /**
          * Check user access to the activity item.
@@ -232 +230 @@
          * @since 3.0.0
          */
-        $has_access = bp_activity_user_can_read( $activity, $user_id );
+        $has_access = bp_activity_user_can_read( $activity );
 
         // If activity author does not match displayed user, block access.
         // More info:https://buddypress.trac.wordpress.org/ticket/7048#comment:28
-        if ( true === $has_access && $user_id !== $activity->user_id ) {
+        if ( true === $has_access && bp_displayed_user_id() !== $activity->user_id ) {
                 $has_access = false;
         }
@@ -252 +250 @@
         // Access is specifically disallowed.
         if ( false === $has_access ) {
-
-                // User feedback.
-                bp_core_add_message( __( 'You do not have access to this activity.', 'buddypress' ), 'error' );
-
-                // Redirect based on logged in status.
-                if ( is_user_logged_in() ) {
-                        $url = bp_loggedin_user_domain();
-
+                // If not logged in, prompt for login.
+                if ( ! is_user_logged_in() ) {
+                        bp_core_no_access();
+
+                // Redirect away.
                 } else {
-                        $url = sprintf(
-                                wp_login_url( 'wp-login.php?redirect_to=%s' ),
-                                esc_url_raw( bp_activity_get_permalink( $action ) )
-                        );
+                        bp_core_add_message( __( 'You do not have access to this activity.', 'buddypress' ), 'error' );
+                        bp_core_redirect( bp_loggedin_user_domain() );
                 }
-
-                bp_core_redirect( $url );
         }