Changeset 13161

Timestamp:

12/08/2021 09:48:57 PM (5 years ago)

Author:

dcavins

Message:

In BP_Members_Admin, add checks for 'edit_users' capability.

BP_Members_Admin checks the bp_moderate
capability in several situations when
checking whether or not the user can
generally edit users is also a sensible check.

Props venutius.

Fixes #8070.
Fixes #8072.
Fixes #8073.

File:

• trunk/src/bp-members/classes/class-bp-members-admin.php (modified) (3 diffs)

trunk/src/bp-members/classes/class-bp-members-admin.php

@@ -359 +359 @@
                 // Trust the 'bp_moderate' capability.
                 } else {
-                        $retval = bp_current_user_can( 'bp_moderate' );
+                        $retval = ( bp_current_user_can( 'edit_users' ) || bp_current_user_can( 'bp_moderate' ) );
                 }
 
@@ -1024 +1024 @@
         public function user_admin() {
 
-                if ( ! bp_current_user_can( 'bp_moderate' ) && empty( $this->is_self_profile ) ) {
+                if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' ) && empty( $this->is_self_profile ) ) {
                         die( '-1' );
                 }
@@ -1400 +1400 @@
 
                 // Permission check.
-                if ( ! bp_current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {
+                if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {
                         return;
                 }