Skip to:
Content

BuddyPress.org

Changeset 8139


Ignore:
Timestamp:
03/17/2014 08:52:35 PM (10 years ago)
Author:
imath
Message:

Check the right capabilities are used in the BP_Admin class

The introduction of the link "About BuddyPress" within the WP Admin Bar revealed that in multisite configurations, some administration menus were accessible to regular administrators when they should be restricted to the Super Administrator.
Now, the capacity used in these menus will be adapted to the configuration in which BuddyPress evolves using a "network" capacity when necessary.

props johnjamesjacoby, boonebgorges, imath

See #5465

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/1.9/bp-core/bp-core-admin.php

    r7676 r8139  
    105105        // Main settings page
    106106        $this->settings_page = bp_core_do_network_admin() ? 'settings.php' : 'options-general.php';
     107
     108        // Main capability
     109        $this->capability = bp_core_do_network_admin() ? 'manage_network_options' : 'manage_options';
    107110    }
    108111
     
    200203            __( 'BuddyPress', 'buddypress' ),
    201204            __( 'BuddyPress', 'buddypress' ),
    202             'manage_options',
     205            $this->capability,
    203206            'bp-general-settings',
    204207            'bp_core_admin_backpat_menu',
     
    210213            __( 'BuddyPress Help', 'buddypress' ),
    211214            __( 'Help', 'buddypress' ),
    212             'manage_options',
     215            $this->capability,
    213216            'bp-general-settings',
    214217            'bp_core_admin_backpat_page'
     
    220223            __( 'BuddyPress Components', 'buddypress' ),
    221224            __( 'BuddyPress', 'buddypress' ),
    222             'manage_options',
     225            $this->capability,
    223226            'bp-components',
    224227            'bp_core_admin_components_settings'
     
    229232            __( 'BuddyPress Pages', 'buddypress' ),
    230233            __( 'BuddyPress Pages', 'buddypress' ),
    231             'manage_options',
     234            $this->capability,
    232235            'bp-page-settings',
    233236            'bp_core_admin_slugs_settings'
     
    238241            __( 'BuddyPress Settings', 'buddypress' ),
    239242            __( 'BuddyPress Settings', 'buddypress' ),
    240             'manage_options',
     243            $this->capability,
    241244            'bp-settings',
    242245            'bp_core_admin_settings'
     
    460463                    <h4><?php _e( 'Your Default Setup', 'buddypress' ); ?></h4>
    461464
    462                     <?php if ( bp_is_active( 'members' ) && bp_is_active( 'activity' ) ) : ?>
     465                    <?php if ( bp_is_active( 'members' ) && bp_is_active( 'activity' ) && current_user_can( $this->capability ) ) : ?>
    463466                        <p><?php printf(
    464467                        __( 'BuddyPress&#8217;s powerful features help your users connect and collaborate. To help get your community started, we&#8217;ve activated two of the most commonly used tools in BP: <strong>Extended Profiles</strong> and <strong>Activity Streams</strong>. See these components in action at the %1$s and %2$s directories, and be sure to spend a few minutes <a href="%3$s">configuring user profiles</a>. Want to explore more of BP&#8217;s features? Visit the <a href="%4$s">Components panel</a>.', 'buddypress' ),
     
    528531                </div>
    529532
    530                 <div class="return-to-dashboard">
    531                     <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
    532                 </div>
     533                <?php if ( current_user_can( $this->capability ) ) :?>
     534                    <div class="return-to-dashboard">
     535                        <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
     536                    </div>
     537                <?php endif ;?>
    533538
    534539            </div>
     
    659664            </p>
    660665
    661             <div class="return-to-dashboard">
    662                 <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
    663             </div>
     666            <?php if ( current_user_can( $this->capability ) ) :?>
     667                <div class="return-to-dashboard">
     668                    <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
     669                </div>
     670            <?php endif;?>
    664671
    665672        </div>
Note: See TracChangeset for help on using the changeset viewer.