Changeset 13512

Timestamp:

07/09/2023 10:06:30 AM (3 years ago)

Author:

imath

Message:

Check the requested Member’s page matches a valid nav screen function

The BP_Members_Component::check_parsed_query() method happens once the query is parsed & once the single displayed Member's navigation is set. It checks the current action matches a navigation slug & whether the corresponding screen function exists and is callable. If it's not the case a 404 is displayed, just like it's currently the case when the BP Legacy URL parser is in use.

See #4954
Fixes #8932
Closes ​https://github.com/buddypress/buddypress/pull/125

File:

• trunk/src/bp-members/classes/class-bp-members-component.php (modified) (2 diffs)

trunk/src/bp-members/classes/class-bp-members-component.php

@@ -205 +205 @@
                         require_once $this->path . 'bp-members/screens/invitations.php';
                 }
+        }
+
+        /**
+         * Set up the component actions.
+         *
+         * @since 12.0.0
+         */
+        public function setup_actions() {
+                parent::setup_actions();
+
+                // Check the parsed query is consistent with the Members navigation.
+                add_action( 'bp_parse_query',  array( $this, 'check_parsed_query' ), 999, 0 );
         }
 
@@ -957 +969 @@
 
         /**
+         * Check the parsed query is consistent with Members navigation.
+         *
+         * As the members’ component pages need a valid screen function to load the right BP Template,
+         * we need to make sure the current single item action exists inside the Members navigation and
+         * that the corresponding screen function is a valid callback.
+         *
+         * @since 12.0.0
+         */
+        public function check_parsed_query() {
+                $single_item_component = '';
+                if ( bp_is_user() ) {
+                        $single_item_component = bp_current_component();
+                }
+
+                $single_item_action = '';
+                if ( $single_item_component ) {
+                        $single_item_action = bp_current_action();
+                }
+
+                $bp = buddypress();
+                if ( isset( $bp->{$single_item_component}, $bp->{$single_item_component}->sub_nav ) ) {
+                        $screen_functions = wp_list_pluck( $bp->{$single_item_component}->sub_nav, 'screen_function', 'slug' );
+
+                        if ( ! $single_item_action || ! isset( $screen_functions[ $single_item_action ] ) || ! is_callable( $screen_functions[ $single_item_action ] ) ) {
+                                bp_do_404();
+                                return;
+                        }
+                }
+        }
+
+        /**
          * Init the BP REST API.
          *