Changeset 14214

Timestamp:

07/07/2026 08:02:23 PM (6 weeks ago)

Author:

dcavins

Message:

Components: Restrict updates to site admins.

Ensure that the current user has the manage_options capability before allowing them to change BuddyPress component status.

Special thanks to kasthelord (Lukas Collishaw) who first reported this issue responsibly.

Props emaralive, johnjamesjacoby, espellcaste, kasthelord (Lukas Collishaw), 1353594865qq, jeromewincek (Jerome Wincek), vvh1te3zz.

Location:

trunk

Files:

• src/bp-core/classes/class-bp-core-components-rest-controller.php (modified) (1 diff)
• tests/phpunit/testcases/core/test-components-controller.php (modified) (1 diff)

trunk/src/bp-core/classes/class-bp-core-components-rest-controller.php

@@ -267 +267 @@
          */
         public function update_item_permissions_check( $request ) {
-                $retval = $this->get_items_permissions_check( $request );
+                $retval = new WP_Error(
+                        'bp_rest_authorization_required',
+                        __( 'Sorry, you are not allowed to perform this action.', 'buddypress' ),
+                        array(
+                                'status' => rest_authorization_required_code(),
+                        )
+                );
+
+                // Unlike `get_items`, toggling a component is an admin-only operation.
+                if ( bp_current_user_can( 'manage_options' ) ) {
+                        $retval = true;
+                }
 
                 /**

trunk/tests/phpunit/testcases/core/test-components-controller.php

@@ -347 +347 @@
 
         /**
+         * @group update_item
+         */
+        public function test_update_item_site_admin_only() {
+                $u = static::factory()->user->create(
+                        array(
+                                'role' => 'author',
+                        )
+                );
+
+                $this->bp::set_current_user( $u );
+
+                // Snapshot so we can prove no component was toggled.
+                $before = bp_get_option( 'bp-active-components' );
+
+                $request = new WP_REST_Request( 'PUT', $this->endpoint_url );
+                $request->set_query_params( array(
+                        'name'   => 'friends',
+                        'action' => 'deactivate',
+                ) );
+                $response = $this->server->dispatch( $request );
+
+                $this->assertErrorResponse( 'bp_rest_authorization_required', $response, 403 );
+
+                // The component toggle must not have executed.
+                $this->assertSame( $before, bp_get_option( 'bp-active-components' ) );
+        }
+
+        /**
          * @group delete_item
          */