Changeset 13512 for trunk/src/bp-members/classes/class-bp-members-component.php

Timestamp:

07/09/2023 10:06:30 AM (17 months ago)

Author:

imath

Message:

Check the requested Member’s page matches a valid nav screen function

The BP_Members_Component::check_parsed_query() method happens once the query is parsed & once the single displayed Member's navigation is set. It checks the current action matches a navigation slug & whether the corresponding screen function exists and is callable. If it's not the case a 404 is displayed, just like it's currently the case when the BP Legacy URL parser is in use.

See #4954
Fixes #8932
Closes ​https://github.com/buddypress/buddypress/pull/125

File:

• trunk/src/bp-members/classes/class-bp-members-component.php (modified) (2 diffs)

trunk/src/bp-members/classes/class-bp-members-component.php

@@ -205 +205 @@
             require_once $this->path . 'bp-members/screens/invitations.php';
         }
+    }
+
+    /**
+     * Set up the component actions.
+     *
+     * @since 12.0.0
+     */
+    public function setup_actions() {
+        parent::setup_actions();
+
+        // Check the parsed query is consistent with the Members navigation.
+        add_action( 'bp_parse_query',  array( $this, 'check_parsed_query' ), 999, 0 );
     }
 
@@ -957 +969 @@
 
     /**
+     * Check the parsed query is consistent with Members navigation.
+     *
+     * As the members’ component pages need a valid screen function to load the right BP Template,
+     * we need to make sure the current single item action exists inside the Members navigation and
+     * that the corresponding screen function is a valid callback.
+     *
+     * @since 12.0.0
+     */
+    public function check_parsed_query() {
+        $single_item_component = '';
+        if ( bp_is_user() ) {
+            $single_item_component = bp_current_component();
+        }
+
+        $single_item_action = '';
+        if ( $single_item_component ) {
+            $single_item_action = bp_current_action();
+        }
+
+        $bp = buddypress();
+        if ( isset( $bp->{$single_item_component}, $bp->{$single_item_component}->sub_nav ) ) {
+            $screen_functions = wp_list_pluck( $bp->{$single_item_component}->sub_nav, 'screen_function', 'slug' );
+
+            if ( ! $single_item_action || ! isset( $screen_functions[ $single_item_action ] ) || ! is_callable( $screen_functions[ $single_item_action ] ) ) {
+                bp_do_404();
+                return;
+            }
+        }
+    }
+
+    /**
      * Init the BP REST API.
      *