Skip to:
Content

BuddyPress.org

Changeset 13870


Ignore:
Timestamp:
05/24/2024 05:43:34 AM (2 years ago)
Author:
imath
Message:

Groups: improve group activity moderation delegation to admins & mods

  • Introduce a new BP Groups global setting to let Site Administrators decide whether group admins & mods can delete their group activities or not.
  • NB: Group creators can keep the control about who can delete their group activities using group role promotion (allow: promote some members as mods or admins. Disallow: do not promote anyone).
  • Make sure the bp_groups_filter_activity_user_can_delete() filter takes in account this setting and behaves as expected (eventually allowing group admins/mods to delete group activities).
  • Add unit tests

This ticket is a perfect example of a great collaborative work between all members of the BP Team. Great job 💪.

Props: emaralive, vapvarun, dcavins, espellcaste, needle

Fixes #8728
Closes ​https://github.com/buddypress/buddypress/pull/278

Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/bp-core/admin/bp-core-admin-settings.php

    r13818 r13870  
    352352}
    353353
     354/**
     355 * 'Enable group activity deletions.
     356 *
     357 * @since 14.0.0
     358 */
     359function bp_admin_setting_callback_group_activity_deletions() {
     360?>
     361        <input id="bp-disable-group-activity-deletions" name="bp-disable-group-activity-deletions" type="checkbox" value="1" <?php checked( ! bp_disable_group_activity_deletions() ); ?> />
     362        <label for="bp-disable-group-activity-deletions"><?php esc_html_e( "Allow group administrators and moderators to delete activity items from their group's activity stream", 'buddypress' ); ?></label>
     363<?php
     364}
     365
    354366/** Account settings Section ************************************************************/
    355367
    … …  
    436448                        'bp-disable-group-avatar-uploads',
    437449                        'bp-disable-group-cover-image-uploads',
     450                        'bp-disable-group-activity-deletions',
    438451                        'bp_disable_blogforum_comments',
    439452                        'bp-disable-profile-sync',

  • trunk/src/bp-core/bp-core-options.php

    r13533 r13870  
    6262                // Group Cover image uploads.
    6363                'bp-disable-group-cover-image-uploads' => false,
     64
     65                // Allow Group Activity Deletions.
     66                'bp-disable-group-activity-deletions'   => false,
    6467
    6568                // Allow users to delete their own accounts.
    … …  
    587590
    588591/**
     592 * Are group activity deletions disabled?
     593 *
     594 * @since 14.0.0
     595 *
     596 * @param bool $default Optional. Fallback value if not found in the database.
     597 *                      Default: false.
     598 * @return bool True if group activity deletions are disabled, otherwise false.
     599 */
     600function bp_disable_group_activity_deletions( $default = false ) {
     601
     602        /**
     603         * Filters whether or not group creator, group admin or group mod are able to delete group activity posts.
     604         *
     605         * @since 14.0.0
     606         *
     607         * @param bool $value Whether or not group creator, group admin or group mod are able to delete group activity post.
     608         */
     609        return (bool) apply_filters( 'bp_disable_group_activity_deletions', (bool) bp_get_option( 'bp-disable-group-activity-deletions', $default ) );
     610}
     611
     612/**
    589613 * Are members able to delete their own accounts?
    590614 *

  • trunk/src/bp-core/classes/class-bp-admin.php

    r13868 r13870  
    570570                                register_setting( 'buddypress', 'bp-disable-group-cover-image-uploads', 'intval' );
    571571                        }
     572
     573                        // Allow group activity deletions.
     574                        add_settings_field( 'bp-disable-group-activity-deletions', esc_html__( 'Group Activity Deletions', 'buddypress' ), 'bp_admin_setting_callback_group_activity_deletions', 'buddypress', 'bp_groups' );
     575                        register_setting( 'buddypress', 'bp-disable-group-activity-deletions', 'intval' );
    572576                }
    573577

  • trunk/src/bp-groups/bp-groups-activity.php

    r13496 r13870  
    651651 */
    652652function bp_groups_filter_activity_user_can_delete( $retval, $activity ) {
    653         // Bail if no current user.
    654         if ( ! is_user_logged_in() ) {
     653        // Bail if no current user or group activity deletions are disabled.
     654        if ( ! is_user_logged_in() || bp_disable_group_activity_deletions() ) {
    655655                return $retval;
    656656        }
    657657
    658         if ( isset( $activity->component ) || 'groups' !== $activity->component ) {
     658        if ( ! isset( $activity->component ) || 'groups' !== $activity->component ) {
    659659                return $retval;
    660660        }
    661661
    662         // Trust the passed value for administrators.
    663         if ( bp_current_user_can( 'bp_moderate' ) ) {
     662        // The first conditional statement will trust the passed value for administrators.
     663        // The second conditional statement does not allow "site admin" activity posts to be deleted by "non site admins".
     664        if ( bp_current_user_can( 'bp_moderate' ) || bp_user_can( $activity->user_id, 'bp_moderate' ) ) {
    664665                return $retval;
    665666        }
    666667
    667         // Group administrators or moderators can delete content in that group that doesn't belong to them.
    668668        $group_id = $activity->item_id;
     669
     670        // Group administrators or moderators can delete content in which deletions are allowed for that group.
    669671        if ( groups_is_user_admin( bp_loggedin_user_id(), $group_id ) || groups_is_user_mod( bp_loggedin_user_id(), $group_id ) ) {
    670672                $retval = true;

  • trunk/tests/phpunit/testcases/groups/activity.php

    r13437 r13870  
    354354                return $args;
    355355        }
     356
     357        /**
     358         * @ticket BP8728
     359         */
     360        public function test_user_can_delete_group_activity() {
     361                $u1             = self::factory()->user->create();
     362                $u2             = self::factory()->user->create();
     363                $original_user = bp_loggedin_user_id();
     364
     365                $this->set_current_user( $u1 );
     366
     367                $g = self::factory()->group->create();
     368
     369                $a = self::factory()->activity->create(
     370                        array(
     371                                'user_id'   => $u2,
     372                                'component' => buddypress()->groups->id,
     373                                'type'      => 'activity_update',
     374                                'item_id'   => $g,
     375                                'content'   => 'Random content',
     376                        )
     377                );
     378
     379                // Activity for group creator.
     380                $b = self::factory()->activity->create(
     381                        array(
     382                                'user_id'   => $u1,
     383                                'component' => buddypress()->groups->id,
     384                                'type'      => 'activity_update',
     385                                'item_id'   => $g,
     386                                'content'   => 'Random content',
     387                        )
     388                );
     389
     390                // Add user to group.
     391                self::add_user_to_group( $u2, $g );
     392
     393                $activity   = self::factory()->activity->get_object_by_id( $a );
     394                $activity_b = self::factory()->activity->get_object_by_id( $b );
     395
     396                // User can delete his own activity.
     397                $this->set_current_user( $u2 );
     398                $this->assertTrue( bp_activity_user_can_delete( $activity ) );
     399
     400                // Activity from site admins can't be deleted by non site admins.
     401                $this->set_current_user( $u2 );
     402                $this->assertFalse( bp_activity_user_can_delete( $activity_b ) );
     403
     404                // Activity from site admins can be deleted by other site admins.
     405                $site_admin = self::factory()->user->create( array( 'role' => 'administrator' ) );
     406                $this->set_current_user( $site_admin );
     407                $this->assertTrue( bp_activity_user_can_delete( $activity_b ) );
     408
     409                // Group creator can delete activity.
     410                $this->set_current_user( $u1 );
     411                $this->assertTrue( bp_activity_user_can_delete( $activity ) );
     412
     413                // Logged-out user can't delete activity.
     414                $this->set_current_user( 0 );
     415                $this->assertFalse( bp_activity_user_can_delete( $activity ) );
     416
     417                // Misc user can't delete activity.
     418                $misc_user = self::factory()->user->create( array( 'role' => 'subscriber' ) );
     419                $this->set_current_user( $misc_user );
     420                $this->assertFalse( bp_activity_user_can_delete( $activity ) );
     421
     422                // Misc group member can't delete activity.
     423                $misc_user_2 = self::factory()->user->create( array( 'role' => 'subscriber' ) );
     424                self::add_user_to_group( $misc_user_2, $g );
     425                $this->set_current_user( $misc_user_2 );
     426                $this->assertFalse( bp_activity_user_can_delete( $activity ) );
     427
     428                // Group mod can delete activity.
     429                $misc_user_3 = self::factory()->user->create( array( 'role' => 'subscriber' ) );
     430                self::add_user_to_group( $misc_user_3, $g, [ 'is_mod' => true ] );
     431                $this->set_current_user( $misc_user_3 );
     432                $this->assertTrue( bp_activity_user_can_delete( $activity ) );
     433
     434                // Group admin can delete activity.
     435                $misc_user_4 = self::factory()->user->create( array( 'role' => 'subscriber' ) );
     436                self::add_user_to_group( $misc_user_4, $g, [ 'is_admin' => true ] );
     437                $this->set_current_user( $misc_user_4 );
     438                $this->assertTrue( bp_activity_user_can_delete( $activity ) );
     439
     440                $this->set_current_user( $original_user );
     441        }
     442
     443        /**
     444         * @ticket BP8728
     445         */
     446        public function test_group_admins_cannot_delete_activity() {
     447                $u1            = self::factory()->user->create();
     448                $u2            = self::factory()->user->create();
     449                $original_user = bp_loggedin_user_id();
     450
     451                $this->set_current_user( $u1 );
     452
     453                $g  = self::factory()->group->create();
     454                $g2 = self::factory()->group->create();
     455                $a  = self::factory()->activity->create(
     456                        array(
     457                                'user_id'   => $u1,
     458                                'content'   => 'Random Activity content',
     459                        )
     460                );
     461
     462                // Activity for group creator.
     463                $a2 = self::factory()->activity->create(
     464                        array(
     465                                'user_id'   => $u1,
     466                                'component' => buddypress()->groups->id,
     467                                'type'      => 'activity_update',
     468                                'item_id'   => $g,
     469                                'content'   => 'Random first Group Activity content',
     470                        )
     471                );
     472
     473                $a3 = self::factory()->activity->create(
     474                        array(
     475                                'user_id'   => $u1,
     476                                'component' => buddypress()->groups->id,
     477                                'type'      => 'activity_update',
     478                                'item_id'   => $g2,
     479                                'content'   => 'Random second Group Activity content',
     480                        )
     481                );
     482
     483                $activity = self::factory()->activity->get_object_by_id( $a );
     484
     485                // Add u2 as Admin of g2.
     486                self::add_user_to_group( $u2, $g, [ 'is_admin' => true ] );
     487
     488                $this->set_current_user( $u2 );
     489                $this->assertFalse( bp_activity_user_can_delete( $activity ), 'Group Admins or Mods shouldn not be able to delete activities that are not attached to a group' );
     490
     491                $activity = self::factory()->activity->get_object_by_id( $a2 );
     492
     493                add_filter( 'bp_disable_group_activity_deletions', '__return_true' );
     494
     495                $this->assertFalse( bp_activity_user_can_delete( $activity ), 'Group Admins or Mods should not be able to delete group activities when Site admin globally disallowed it.' );
     496
     497                remove_filter( 'bp_disable_group_activity_deletions', '__return_true' );
     498
     499                $activity = self::factory()->activity->get_object_by_id( $a3 );
     500                $this->assertFalse( bp_activity_user_can_delete( $activity ), 'Group Admins or Mods should not be able to delete another group activities.' );
     501
     502                $this->set_current_user( $original_user );
     503        }
    356504}
Note: See TracChangeset for help on using the changeset viewer.