Changeset 12502

Timestamp:

12/04/2019 01:10:19 PM (7 years ago)

Author:

dcavins

Message:

Nouveau: Fix group uninivite AJAX handler logic.

Ensure that site admins, group admins and the original inviter can all delete a pending invitation.

Fixes #8167.

File:

• branches/5.0/src/bp-templates/bp-nouveau/includes/groups/ajax.php (modified) (2 diffs)

branches/5.0/src/bp-templates/bp-nouveau/includes/groups/ajax.php

@@ -471 +471 @@
         }
 
-        // Verify pending invite.
-        $invites_args = array(
-                'is_confirmed' => false,
-                'is_banned'    => null,
-                'is_admin'     => null,
-                'is_mod'       => null,
-        );
-        $invites = bp_get_user_groups( $user_id, $invites_args );
-        if ( empty( $invites ) ) {
-                wp_send_json_error( $response );
-        }
-
-        if ( ! groups_is_user_admin( bp_loggedin_user_id(), $group_id ) ) {
-                wp_send_json_error( $response );
-        }
-
-        if ( BP_Groups_Member::check_for_membership_request( $user_id, $group_id ) ) {
+        // Verify that a sent invite exists.
+        $inviter_ids = groups_get_invites( array(
+                'user_id'     => $user_id,
+                'item_id'     => $group_id,
+                'invite_sent' => 'sent',
+                'fields'      => 'inviter_ids'
+        ) );
+
+        if ( empty( $inviter_ids ) ) {
+                wp_send_json_error( $response );
+        }
+
+        // Is the current user the inviter?
+        $inviter_id = in_array( bp_loggedin_user_id(), $inviter_ids, true ) ? bp_loggedin_user_id() : false;
+
+        // A site moderator, group admin or the inviting user should be able to remove an invitation.
+        if ( ! bp_is_item_admin() && ! $inviter_id ) {
+                wp_send_json_error( $response );
+        }
+
+        if ( groups_is_user_member( $user_id, $group_id ) ) {
                 wp_send_json_error(
                         array(
@@ -497 +501 @@
         }
 
-        // Remove the unsent invitation.
-        if ( ! groups_uninvite_user( $user_id, $group_id ) ) {
+        // Remove the invitation.
+        if ( ! groups_uninvite_user( $user_id, $group_id, $inviter_id ) ) {
                 wp_send_json_error(
                         array(