Changeset 11970

Timestamp:

04/13/2018 02:01:12 PM (7 years ago)

Author:

dcavins

Message:

Fix admin user cases in bp_groups_user_can_filter().

If a user is an admin, he or she is pretty much allowed to do anything, so the capability has been approved before bp_groups_user_can_filter() filters the value. In a few cases, even admins need to satisfy a few other requirements before being allowed to do something, like request membership in a group, where even site admins need to not be members of the group.

Props r-a-y, dcavins.

See #7610.

Location:

trunk

Files:

• src/bp-groups/bp-groups-filters.php (modified) (4 diffs)
• tests/phpunit/testcases/groups/user_can.php (modified) (3 diffs)

trunk/src/bp-groups/bp-groups-filters.php

@@ -217 +217 @@
             }
 
+            // Set to false to begin with.
+            $retval = false;
+
             // The group must allow joining, and the user should not currently be a member.
             $group = groups_get_group( $group_id );
-            if ( 'public' === bp_get_group_status( $group )
+            if ( ( 'public' === bp_get_group_status( $group )
                 && ! groups_is_user_member( $user_id, $group->id )
-                && ! groups_is_user_banned( $user_id, $group->id )
+                && ! groups_is_user_banned( $user_id, $group->id ) )
+                // Site admins can join any group they are not a member of.
+                || ( bp_user_can( $user_id, 'bp_moderate' )
+                && ! groups_is_user_member( $user_id, $group->id ) )
             ) {
                 $retval = true;
@@ -232 +238 @@
                 break;
             }
+
+            // Set to false to begin with.
+            $retval = false;
 
             /*
@@ -257 +266 @@
             * currently be a member or be banned from the group.
             */
-            $group = groups_get_group( $group_id );
             // Users with the 'bp_moderate' cap can always send invitations.
             if ( bp_user_can( $user_id, 'bp_moderate' ) ) {
@@ -292 +300 @@
             }
 
+            // Set to false to begin with.
+            $retval = false;
+
             /*
             * The group must allow invitations, and the user should not

trunk/tests/phpunit/testcases/groups/user_can.php

@@ -25 +25 @@
     }
 
+    /**
+     * @ticket BP7610
+     */
+    public function test_user_cannot_join_public_group_if_already_member_even_superadmin() {
+        $g1 = $this->factory->group->create( array(
+            'status'      => 'public'
+        ) );
+        $u1 = $this->factory->user->create();
+        $this->add_user_to_group( $u1, $g1 );
+
+        // Grant super admin status.
+        grant_super_admin( $u1 );
+
+        $this->assertFalse( bp_user_can( $u1, 'groups_join_group', array( 'group_id' => $g1 ) ) );
+    }
+
     public function test_user_cannot_join_private_group() {
         $g1 = $this->factory->group->create( array(
@@ -135 +151 @@
     }
 
+    /**
+     * @ticket BP7610
+     */
+    public function test_user_cannot_receive_invitation_to_private_group_if_already_member_even_superadmin() {
+        $g1 = $this->factory->group->create( array(
+            'status'      => 'private'
+        ) );
+        $u1 = $this->factory->user->create();
+        $this->add_user_to_group( $u1, $g1 );
+
+        // Grant super admin status.
+        grant_super_admin( $u1 );
+
+        $this->assertFalse( bp_user_can( $u1, 'groups_receive_invitation', array( 'group_id' => $g1 ) ) );
+    }
 
     public function test_user_cannot_receive_invitation_to_private_group_if_banned() {
@@ -369 +400 @@
     }
 
+    /**
+     * @ticket BP7610
+     */
+    public function test_user_can_groups_request_membership_for_super_admin() {
+        if ( ! is_multisite() ) {
+            return;
+        }
+
+        $g1 = $this->factory->group->create( array(
+            'status' => 'public'
+        ) );
+        $u1 = $this->factory->user->create();
+        $this->add_user_to_group( $u1, $g1 );
+
+        // Grant super admin status.
+        grant_super_admin( $u1 );
+
+        // Assert false since public groups shouldn't be able to request membership.
+        $this->assertFalse( bp_user_can( $u1, 'groups_request_membership', array( 'group_id' => $g1 ) ) );
+    }
 }