Changeset 14034 for trunk/src/bp-members/classes/class-bp-members-rest-controller.php

Timestamp:

10/02/2024 03:23:39 AM (9 months ago)

Author:

espellcaste

Message:

BP REST API: spammed users can not be retrivied from non-admin users.

Align the BP REST API with the web version, and show spammer users to Administrators only.

Props imath and emaralive.

See #9145
Fixes #9231

File:

• trunk/src/bp-members/classes/class-bp-members-rest-controller.php (modified) (3 diffs)

trunk/src/bp-members/classes/class-bp-members-rest-controller.php

@@ -244 +244 @@
             $member       = reset( $member_query->results );
 
-            $member   = $this->prepare_item_for_response( $member, $request );
-            $response = rest_ensure_response( $member );
-
-            return $response;
+            $member = $this->prepare_item_for_response( $member, $request );
+
+            return rest_ensure_response( $member );
         }
 
@@ -258 +257 @@
      * @since 15.0.0
      *
-     * @param  WP_REST_Request $request Full details about the request.
+     * @param WP_REST_Request $request Full details about the request.
      * @return true|WP_Error
      */
@@ -281 +280 @@
                     )
                 );
-            } elseif ( 'edit' === $request->get_param( 'context' ) ) {
-                if ( get_current_user_id() === $user->ID || bp_current_user_can( 'list_users' ) ) {
-                    $retval = true;
-                } else {
-                    $retval = new WP_Error(
-                        'bp_rest_authorization_required',
-                        __( 'Sorry, you are not allowed to view members with the edit context.', 'buddypress' ),
-                        array(
-                            'status' => rest_authorization_required_code(),
-                        )
-                    );
-                }
-            } else {
+            } elseif ( get_current_user_id() === $user->ID && ! bp_is_user_spammer( $user->ID ) ) {
+                $retval = true;
+            } elseif ( 'edit' === $request->get_param( 'context' ) && ! bp_current_user_can( 'list_users' ) ) {
+                $retval = new WP_Error(
+                    'bp_rest_authorization_required',
+                    __( 'Sorry, you are not allowed to view members with the edit context.', 'buddypress' ),
+                    array( 'status' => rest_authorization_required_code() )
+                );
+            } elseif ( bp_current_user_can( 'bp_moderate' ) || ! bp_is_user_spammer( $user->ID ) ) {
                 $retval = true;
             }