Changeset 13161

Timestamp:

12/08/2021 09:48:57 PM (3 years ago)

Author:

dcavins

Message:

In BP_Members_Admin, add checks for 'edit_users' capability.

BP_Members_Admin checks the bp_moderate
capability in several situations when
checking whether or not the user can
generally edit users is also a sensible check.

Props venutius.

Fixes #8070.
Fixes #8072.
Fixes #8073.

File:

• trunk/src/bp-members/classes/class-bp-members-admin.php (modified) (3 diffs)

trunk/src/bp-members/classes/class-bp-members-admin.php

@@ -359 +359 @@
         // Trust the 'bp_moderate' capability.
         } else {
-            $retval = bp_current_user_can( 'bp_moderate' );
+            $retval = ( bp_current_user_can( 'edit_users' ) || bp_current_user_can( 'bp_moderate' ) );
         }
 
@@ -1024 +1024 @@
     public function user_admin() {
 
-        if ( ! bp_current_user_can( 'bp_moderate' ) && empty( $this->is_self_profile ) ) {
+        if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' ) && empty( $this->is_self_profile ) ) {
             die( '-1' );
         }
@@ -1400 +1400 @@
 
         // Permission check.
-        if ( ! bp_current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {
+        if ( ! bp_current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {
             return;
         }