Changeset 7562

Timestamp:

11/12/2013 03:14:04 PM (11 years ago)

Author:

boonebgorges

Message:

Don't do capabilities checks in bp_core_process_spammer_status()

These inline checks prevent the function from being used programmatically, such
as during a cron job. Instead, we move the cap checks up to the controller
"action" functions.

Fixes #5233

Location:

trunk

Files:

• bp-members/bp-members-actions.php (modified) (1 diff)
• bp-members/bp-members-functions.php (modified) (1 diff)
• bp-settings/bp-settings-actions.php (modified) (1 diff)

trunk/bp-members/bp-members-actions.php

@@ -25 +25 @@
  */
 function bp_core_action_set_spammer_status( $user_id = 0 ) {
+
+    // Only super admins can currently spam users (but they can't spam
+    // themselves)
+    if ( ! is_super_admin() || bp_is_my_profile() ) {
+        return;
+    }
 
     // Use displayed user if it's not yourself

trunk/bp-members/bp-members-functions.php

@@ -534 +534 @@
 
 /**
- * Processes a spammed or unspammed user
- *
- * This function is called in three ways:
- *  - in bp_settings_action_capabilities() (from the front-end)
- *  - by bp_core_mark_user_spam_admin()    (from wp-admin)
- *  - bp_core_mark_user_ham_admin()        (from wp-admin)
- *
- * @since BuddyPress (1.6)
- *
- * @param int $user_id The user being spammed/hammed
- * @param string $status 'spam' if being marked as spam, 'ham' otherwise
+ * Process a spammed or unspammed user.
+ *
+ * This function is called from three places:
+ *
+ * - in bp_settings_action_capabilities() (from the front-end)
+ * - by bp_core_mark_user_spam_admin()    (from wp-admin)
+ * - bp_core_mark_user_ham_admin()        (from wp-admin)
+ *
+ * @since BuddyPress (1.6.0)
+ *
+ * @param int $user_id The ID of the user being spammed/hammed.
+ * @param string $status 'spam' if being marked as spam, 'ham' otherwise.
  */
 function bp_core_process_spammer_status( $user_id, $status ) {
     global $wpdb;
-
-    // Only super admins can currently spam users
-    if ( !is_super_admin() || bp_is_my_profile() )
-        return;
 
     // Bail if no user ID

trunk/bp-settings/bp-settings-actions.php

@@ -279 +279 @@
     }
 
+    // Only super admins can currently spam users (but they can't spam
+    // themselves)
+    if ( ! is_super_admin() || bp_is_my_profile() ) {
+        return;
+    }
+
     // Nonce check
     check_admin_referer( 'capabilities' );