Changeset 12198

Timestamp:

07/28/2018 02:11:48 AM (8 years ago)

Author:

boonebgorges

Message:

Separate action logic from permission logic in bp-legacy joinleave_group AJAX callback.

Prior to [11776], join/leave group button intent was calculated based
directly on the user's group membership status. After that changeset,
the intent was calculated based on permission checks, which encompassed
the membership checks but also some additional information. This caused
problems when a user - such as a super admin - had *permission* to
join a group, but was not actually *trying* to join a group (but instead
had clicked Request Membership).

See #7936.

File:

• trunk/src/bp-templates/bp-legacy/buddypress-functions.php (modified) (2 diffs)

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -1512 +1512 @@
                 return;
 
-        if ( ! groups_is_user_member( bp_loggedin_user_id(), $group->id ) ) {
-                if ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $group->id ) ) ) {
+        // Client doesn't distinguish between different request types, so we infer from user status.
+        if ( groups_is_user_member( bp_loggedin_user_id(), $group->id ) ) {
+                $request_type = 'leave_group';
+        } elseif ( groups_check_user_has_invite( bp_loggedin_user_id(), $group->id ) ) {
+                $request_type = 'accept_invite';
+        } elseif ( 'private' === $group->status ) {
+                $request_type = 'request_membership';
+        } else {
+                $request_type = 'join_group';
+        }
+
+        switch ( $request_type ) {
+                case 'join_group' :
+                        if ( ! bp_current_user_can( 'groups_join_group', array( 'group_id' => $group->id ) ) ) {
+                                esc_html_e( 'Error joining group', 'buddypress' );
+                        }
+
                         check_ajax_referer( 'groups_join_group' );
 
@@ -1521 +1536 @@
                                 echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button leave-group" rel="leave" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'leave-group', 'groups_leave_group' ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';
                         }
-
-                } elseif ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $group->id ) ) ) {
-
-                        // If the user has already been invited, then this is
-                        // an Accept Invitation button.
-                        if ( groups_check_user_has_invite( bp_loggedin_user_id(), $group->id ) ) {
-                                check_ajax_referer( 'groups_accept_invite' );
-
-                                if ( ! groups_accept_invite( bp_loggedin_user_id(), $group->id ) ) {
-                                        _e( 'Error requesting membership', 'buddypress' );
-                                } else {
-                                        echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button leave-group" rel="leave" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'leave-group', 'groups_leave_group' ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';
-                                }
-
-                        // Otherwise, it's a Request Membership button.
+                break;
+
+                case 'accept_invite' :
+                        if ( ! bp_current_user_can( 'groups_request_membership', array( 'group_id' => $group->id ) ) ) {
+                                esc_html_e( 'Error accepting invitation', 'buddypress' );
+                        }
+
+                        check_ajax_referer( 'groups_accept_invite' );
+
+                        if ( ! groups_accept_invite( bp_loggedin_user_id(), $group->id ) ) {
+                                _e( 'Error requesting membership', 'buddypress' );
                         } else {
-                                check_ajax_referer( 'groups_request_membership' );
-
-                                if ( ! groups_send_membership_request( bp_loggedin_user_id(), $group->id ) ) {
-                                        _e( 'Error requesting membership', 'buddypress' );
-                                } else {
-                                        echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button disabled pending membership-requested" rel="membership-requested" href="' . bp_get_group_permalink( $group ) . '">' . __( 'Request Sent', 'buddypress' ) . '</a>';
-                                }
-                        }
-                }
-
-        } else {
-                check_ajax_referer( 'groups_leave_group' );
-
-                if ( ! groups_leave_group( $group->id ) ) {
-                        _e( 'Error leaving group', 'buddypress' );
-                } elseif ( bp_current_user_can( 'groups_join_group', array( 'group_id' => $group->id ) ) ) {
-                        echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button join-group" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'join', 'groups_join_group' ) . '">' . __( 'Join Group', 'buddypress' ) . '</a>';
-                } elseif ( bp_current_user_can( 'groups_request_membership', array( 'group_id' => $group->id ) ) ) {
-                        echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button request-membership" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'request-membership', 'groups_request_membership' ) . '">' . __( 'Request Membership', 'buddypress' ) . '</a>';
-                }
+                                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button leave-group" rel="leave" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'leave-group', 'groups_leave_group' ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';
+                        }
+                break;
+
+                case 'request_membership' :
+                        check_ajax_referer( 'groups_request_membership' );
+
+                        if ( ! groups_send_membership_request( bp_loggedin_user_id(), $group->id ) ) {
+                                _e( 'Error requesting membership', 'buddypress' );
+                        } else {
+                                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button disabled pending membership-requested" rel="membership-requested" href="' . bp_get_group_permalink( $group ) . '">' . __( 'Request Sent', 'buddypress' ) . '</a>';
+                        }
+                break;
+
+                case 'leave_group' :
+                        check_ajax_referer( 'groups_leave_group' );
+
+                        if ( ! groups_leave_group( $group->id ) ) {
+                                _e( 'Error leaving group', 'buddypress' );
+                        } elseif ( 'public' === $group->status ) {
+                                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button join-group" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'join', 'groups_join_group' ) . '">' . __( 'Join Group', 'buddypress' ) . '</a>';
+                        } else {
+                                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button request-membership" rel="join" href="' . wp_nonce_url( bp_get_group_permalink( $group ) . 'request-membership', 'groups_request_membership' ) . '">' . __( 'Request Membership', 'buddypress' ) . '</a>';
+                        }
+                break;
         }