Changeset 7638

Timestamp:

12/02/2013 08:49:29 PM (11 years ago)

Author:

boonebgorges

Message:

Prevent BP_User_Query from fetching spam users on alphabetical sort

BP_User_Query's 'alphabetical' sort type, in contrast to the other values of
'type', does not look at users' last_activity usermeta value. As a result, it
cannot infer spam/deleted/activated status in the same way as the other 'type'
values. To prevent spammed/deleted/unactivated users from being returned on
alphabetical sorts, we do a subquery that limits results to user_status = 0.

Fixes #5114

Props sbrajesh, imath

Location:

trunk

Files:

• bp-core/bp-core-classes.php (modified) (1 diff)
• tests/testcases/core/class-bp-user-query.php (modified) (1 diff)

trunk/bp-core/bp-core-classes.php

@@ -311 +311 @@
                 }
 
+                // Alphabetical queries ignore last_activity, while BP uses last_activity
+                // to infer spam/deleted/non-activated users. To ensure that these users
+                // are filtered out, we add an appropriate sub-query.
+                $sql['where'][] = "u.{$this->uid_name} IN ( SELECT ID FROM {$wpdb->users} WHERE " . bp_core_get_status_sql( '' ) . " )";
+
                 break;
 

trunk/tests/testcases/core/class-bp-user-query.php

@@ -223 +223 @@
         $this->assertEquals( array( $u2 ), $found_user_ids );
     }
+
+    /**
+     * @group type
+     * @group spam
+     */
+    public function test_bp_user_query_type_alphabetical_spam_xprofileon() {
+        if ( is_multisite() ) {
+            return;
+        }
+
+        // Make sure xprofile is on
+        $xprofile_toggle = isset( buddypress()->active_components['xprofile'] );
+        buddypress()->active_components['xprofile'] = 1;
+        add_filter( 'bp_disable_profile_sync', '__return_false' );
+
+        $u1 = $this->create_user();
+        $u2 = $this->create_user();
+
+        global $wpdb;
+        bp_core_process_spammer_status( $u1, 'spam' );
+
+        $q = new BP_User_Query( array( 'type' => 'alphabetical', ) );
+
+        // Restore xprofile setting
+        if ( $xprofile_toggle ) {
+            buddypress()->active_components['xprofile'] = 1;
+        } else {
+            unset( buddypress()->active_components['xprofile'] );
+        }
+        remove_filter( 'bp_disable_profile_sync', '__return_false' );
+
+        $found_user_ids = null;
+
+        if ( ! empty( $q->results ) ) {
+            $found_user_ids = array_values( wp_parse_id_list( wp_list_pluck( $q->results, 'ID' ) ) );
+        }
+
+        // Do a assertNotContains because there are weird issues with user #1 as created by WP
+        $this->assertNotContains( $u1, $found_user_ids );
+    }
+
+    /**
+     * @group type
+     * @group spam
+     */
+    public function test_bp_user_query_type_alphabetical_spam_xprofileoff() {
+        $u1 = $this->create_user();
+        $u2 = $this->create_user();
+
+        // Make sure xprofile and profile sync are off
+        $xprofile_toggle = isset( buddypress()->active_components['xprofile'] );
+        buddypress()->active_components['xprofile'] = 0;
+        add_filter( 'bp_disable_profile_sync', '__return_false' );
+
+        bp_core_process_spammer_status( $u1, 'spam' );
+
+        $q = new BP_User_Query( array( 'type' => 'alphabetical', ) );
+
+        // Restore xprofile setting
+        if ( $xprofile_toggle ) {
+            buddypress()->active_components['xprofile'] = 1;
+        } else {
+            unset( buddypress()->active_components['xprofile'] );
+        }
+        remove_filter( 'bp_disable_profile_sync', '__return_false' );
+
+        $found_user_ids = null;
+
+        if ( ! empty( $q->results ) ) {
+            $found_user_ids = array_values( wp_parse_id_list( wp_list_pluck( $q->results, 'ID' ) ) );
+        }
+
+        // Do a assertNotContains because there are weird issues with user #1 as created by WP
+        $this->assertNotContains( $u1, $found_user_ids );
+    }
+
 }