Changeset 11959

Timestamp:

04/06/2018 04:07:36 PM (7 years ago)

Author:

r-a-y

Message:

Groups: Banned group members shouldn't be able to comment on activity items.

Previously, we did not check activity commenting capabilities against group
membership status.

Props rachelbaker, boonebgorges, imath, DJPaul, r-a-y.

Fixes #4429.

Location:

trunk/src

Files:

• bp-activity/bp-activity-template.php (modified) (1 diff)
• bp-groups/bp-groups-activity.php (modified) (1 diff)

trunk/src/bp-activity/bp-activity-template.php

@@ -2947 +2947 @@
      *
      * @param bool   $can_comment Status on if activity reply can be commented on.
-     * @param string $comment     Current comment being checked on.
+     * @param object $comment     Current comment object being checked on.
      */
     return (bool) apply_filters( 'bp_activity_can_comment_reply', $can_comment, $comment );

trunk/src/bp-groups/bp-groups-activity.php

@@ -359 +359 @@
 
 /**
+ * Function used to determine if a user can comment on a group activity item.
+ *
+ * Used as a filter callback to 'bp_activity_can_comment'.
+ *
+ * @since 3.0.0
+ *
+ * @param  bool                      $retval   True if item can receive comments.
+ * @param  null|BP_Activity_Activity $activity Null by default. Pass an activity object to check against that instead.
+ * @return bool
+ */
+function bp_groups_filter_activity_can_comment( $retval, $activity = null ) {
+    // Bail if item cannot receive comments or if no current user.
+    if ( empty( $retval ) || ! is_user_logged_in() ) {
+        return $retval;
+    }
+
+    // Use passed activity object, if available.
+    if ( is_a( $activity, 'BP_Activity_Activity' ) ) {
+        $component = $activity->component;
+        $group_id  = $activity->item_id;
+
+    // Use activity info from current activity item in the loop.
+    } else {
+        $component = bp_get_activity_object_name();
+        $group_id  = bp_get_activity_item_id();
+    }
+
+    // If not a group activity item, bail.
+    if ( 'groups' !== $component ) {
+        return $retval;
+    }
+
+    // If current user is not a group member or is banned, user cannot comment.
+    if ( ! bp_current_user_can( 'bp_moderate' ) &&
+        ( ! groups_is_user_member( bp_loggedin_user_id(), $group_id ) || ! groups_is_user_banned( bp_loggedin_user_id(), $group_id ) )
+    ) {
+        $retval = false;
+    }
+
+    return $retval;
+}
+add_filter( 'bp_activity_can_comment', 'bp_groups_filter_activity_can_comment', 99, 1 );
+
+/**
+ * Function used to determine if a user can reply on a group activity comment.
+ *
+ * Used as a filter callback to 'bp_activity_can_comment_reply'.
+ *
+ * @since 3.0.0
+ *
+ * @param  bool        $retval  True if activity comment can be replied to.
+ * @param  object|bool $comment Current activity comment object. If empty, parameter is boolean false.
+ * @return bool
+ */
+function bp_groups_filter_activity_can_comment_reply( $retval, $comment ) {
+    // Bail if no current user, if comment is empty or if retval is already empty.
+    if ( ! is_user_logged_in() || empty( $comment ) || empty( $retval ) ) {
+        return $retval;
+    }
+
+    // Grab parent activity item.
+    $parent = new BP_Activity_Activity( $comment->item_id );
+
+    // Check to see if user can reply to parent group activity item.
+    return bp_groups_filter_activity_can_comment( $retval, $parent );
+}
+add_filter( 'bp_activity_can_comment_reply', 'bp_groups_filter_activity_can_comment_reply', 99, 2 );
+
+/**
  * Update the last_activity meta value for a given group.
  *