Changeset 12501

Timestamp:

12/04/2019 01:07:27 PM (5 years ago)

Author:

dcavins

Message:

Nouveau: Fix group uninivite AJAX handler logic.

Ensure that site admins, group admins and the original inviter can all delete a pending invitation.

Fixes #8167.

File:

• trunk/src/bp-templates/bp-nouveau/includes/groups/ajax.php (modified) (2 diffs)

trunk/src/bp-templates/bp-nouveau/includes/groups/ajax.php

@@ -471 +471 @@
     }
 
-    // Verify pending invite.
-    $invites_args = array(
-        'is_confirmed' => false,
-        'is_banned'    => null,
-        'is_admin'     => null,
-        'is_mod'       => null,
-    );
-    $invites = bp_get_user_groups( $user_id, $invites_args );
-    if ( empty( $invites ) ) {
-        wp_send_json_error( $response );
-    }
-
-    if ( ! groups_is_user_admin( bp_loggedin_user_id(), $group_id ) ) {
-        wp_send_json_error( $response );
-    }
-
-    if ( BP_Groups_Member::check_for_membership_request( $user_id, $group_id ) ) {
+    // Verify that a sent invite exists.
+    $inviter_ids = groups_get_invites( array(
+        'user_id'     => $user_id,
+        'item_id'     => $group_id,
+        'invite_sent' => 'sent',
+        'fields'      => 'inviter_ids'
+    ) );
+
+    if ( empty( $inviter_ids ) ) {
+        wp_send_json_error( $response );
+    }
+
+    // Is the current user the inviter?
+    $inviter_id = in_array( bp_loggedin_user_id(), $inviter_ids, true ) ? bp_loggedin_user_id() : false;
+
+    // A site moderator, group admin or the inviting user should be able to remove an invitation.
+    if ( ! bp_is_item_admin() && ! $inviter_id ) {
+        wp_send_json_error( $response );
+    }
+
+    if ( groups_is_user_member( $user_id, $group_id ) ) {
         wp_send_json_error(
             array(
@@ -497 +501 @@
     }
 
-    // Remove the unsent invitation.
-    if ( ! groups_uninvite_user( $user_id, $group_id ) ) {
+    // Remove the invitation.
+    if ( ! groups_uninvite_user( $user_id, $group_id, $inviter_id ) ) {
         wp_send_json_error(
             array(