Skip to:
Content

BuddyPress.org

Changeset 11959


Ignore:
Timestamp:
04/06/2018 04:07:36 PM (6 years ago)
Author:
r-a-y
Message:

Groups: Banned group members shouldn't be able to comment on activity items.

Previously, we did not check activity commenting capabilities against group
membership status.

Props rachelbaker, boonebgorges, imath, DJPaul, r-a-y.

Fixes #4429.

Location:
trunk/src
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/bp-activity/bp-activity-template.php

    r11837 r11959  
    29472947     *
    29482948     * @param bool   $can_comment Status on if activity reply can be commented on.
    2949      * @param string $comment     Current comment being checked on.
     2949     * @param object $comment     Current comment object being checked on.
    29502950     */
    29512951    return (bool) apply_filters( 'bp_activity_can_comment_reply', $can_comment, $comment );
  • trunk/src/bp-groups/bp-groups-activity.php

    r11805 r11959  
    359359
    360360/**
     361 * Function used to determine if a user can comment on a group activity item.
     362 *
     363 * Used as a filter callback to 'bp_activity_can_comment'.
     364 *
     365 * @since 3.0.0
     366 *
     367 * @param  bool                      $retval   True if item can receive comments.
     368 * @param  null|BP_Activity_Activity $activity Null by default. Pass an activity object to check against that instead.
     369 * @return bool
     370 */
     371function bp_groups_filter_activity_can_comment( $retval, $activity = null ) {
     372    // Bail if item cannot receive comments or if no current user.
     373    if ( empty( $retval ) || ! is_user_logged_in() ) {
     374        return $retval;
     375    }
     376
     377    // Use passed activity object, if available.
     378    if ( is_a( $activity, 'BP_Activity_Activity' ) ) {
     379        $component = $activity->component;
     380        $group_id  = $activity->item_id;
     381
     382    // Use activity info from current activity item in the loop.
     383    } else {
     384        $component = bp_get_activity_object_name();
     385        $group_id  = bp_get_activity_item_id();
     386    }
     387
     388    // If not a group activity item, bail.
     389    if ( 'groups' !== $component ) {
     390        return $retval;
     391    }
     392
     393    // If current user is not a group member or is banned, user cannot comment.
     394    if ( ! bp_current_user_can( 'bp_moderate' ) &&
     395        ( ! groups_is_user_member( bp_loggedin_user_id(), $group_id ) || ! groups_is_user_banned( bp_loggedin_user_id(), $group_id ) )
     396    ) {
     397        $retval = false;
     398    }
     399
     400    return $retval;
     401}
     402add_filter( 'bp_activity_can_comment', 'bp_groups_filter_activity_can_comment', 99, 1 );
     403
     404/**
     405 * Function used to determine if a user can reply on a group activity comment.
     406 *
     407 * Used as a filter callback to 'bp_activity_can_comment_reply'.
     408 *
     409 * @since 3.0.0
     410 *
     411 * @param  bool        $retval  True if activity comment can be replied to.
     412 * @param  object|bool $comment Current activity comment object. If empty, parameter is boolean false.
     413 * @return bool
     414 */
     415function bp_groups_filter_activity_can_comment_reply( $retval, $comment ) {
     416    // Bail if no current user, if comment is empty or if retval is already empty.
     417    if ( ! is_user_logged_in() || empty( $comment ) || empty( $retval ) ) {
     418        return $retval;
     419    }
     420
     421    // Grab parent activity item.
     422    $parent = new BP_Activity_Activity( $comment->item_id );
     423
     424    // Check to see if user can reply to parent group activity item.
     425    return bp_groups_filter_activity_can_comment( $retval, $parent );
     426}
     427add_filter( 'bp_activity_can_comment_reply', 'bp_groups_filter_activity_can_comment_reply', 99, 2 );
     428
     429/**
    361430 * Update the last_activity meta value for a given group.
    362431 *
Note: See TracChangeset for help on using the changeset viewer.