Changeset 8140 for trunk/bp-core/bp-core-admin.php

Timestamp:

03/17/2014 08:58:00 PM (12 years ago)

Author:

imath

Message:

Check the right capabilities are used in the BP_Admin class

The introduction of the link "About BuddyPress" within the WP Admin Bar revealed that in multisite configurations, some administration menus were accessible to regular administrators when they should be restricted to the Super Administrator.
Now, the capacity used in these menus will be adapted to the configuration in which BuddyPress evolves using a "network" capacity when necessary.

props johnjamesjacoby, boonebgorges, imath

Fixes #5465

File:

• trunk/bp-core/bp-core-admin.php (modified) (12 diffs)

trunk/bp-core/bp-core-admin.php

@@ -105 +105 @@
                 // Main settings page
                 $this->settings_page = bp_core_do_network_admin() ? 'settings.php' : 'options-general.php';
+
+                // Main capability
+                $this->capability = bp_core_do_network_admin() ? 'manage_network_options' : 'manage_options';
         }
 
@@ -205 +208 @@
                         __( 'BuddyPress', 'buddypress' ),
                         __( 'BuddyPress', 'buddypress' ),
-                        'manage_options',
+                        $this->capability,
                         'bp-general-settings',
                         'bp_core_admin_backpat_menu',
@@ -215 +218 @@
                         __( 'BuddyPress Help', 'buddypress' ),
                         __( 'Help', 'buddypress' ),
-                        'manage_options',
+                        $this->capability,
                         'bp-general-settings',
                         'bp_core_admin_backpat_page'
@@ -225 +228 @@
                         __( 'BuddyPress Components', 'buddypress' ),
                         __( 'BuddyPress', 'buddypress' ),
-                        'manage_options',
+                        $this->capability,
                         'bp-components',
                         'bp_core_admin_components_settings'
@@ -234 +237 @@
                         __( 'BuddyPress Pages', 'buddypress' ),
                         __( 'BuddyPress Pages', 'buddypress' ),
-                        'manage_options',
+                        $this->capability,
                         'bp-page-settings',
                         'bp_core_admin_slugs_settings'
@@ -243 +246 @@
                         __( 'BuddyPress Settings', 'buddypress' ),
                         __( 'BuddyPress Settings', 'buddypress' ),
-                        'manage_options',
+                        $this->capability,
                         'bp-settings',
                         'bp_core_admin_settings'
@@ -256 +259 @@
                                 __( 'Tools', 'buddypress' ),
                                 __( 'Tools', 'buddypress' ),
-                                'manage_network_options',
+                                $this->capability,
                                 $tools_parent,
                                 'bp_core_tools_top_level_item',
@@ -267 +270 @@
                                 __( 'Available Tools', 'buddypress' ),
                                 __( 'Available Tools', 'buddypress' ),
-                                'manage_network_options',
+                                $this->capability,
                                 'available-tools',
                                 'bp_core_admin_available_tools_page'
@@ -279 +282 @@
                         __( 'BuddyPress Tools', 'buddypress' ),
                         __( 'BuddyPress', 'buddypress' ),
-                        'manage_options',
+                        $this->capability,
                         'bp-tools',
                         'bp_core_admin_tools'
@@ -517 +520 @@
                                         <h4><?php _e( 'Your Default Setup', 'buddypress' ); ?></h4>
 
-                                        <?php if ( bp_is_active( 'members' ) && bp_is_active( 'activity' ) ) : ?>
+                                        <?php if ( bp_is_active( 'members' ) && bp_is_active( 'activity' ) && current_user_can( $this->capability ) ) : ?>
                                                 <p><?php printf(
                                                 __( 'BuddyPress&#8217;s powerful features help your users connect and collaborate. To help get your community started, we&#8217;ve activated two of the most commonly used tools in BP: <strong>Extended Profiles</strong> and <strong>Activity Streams</strong>. See these components in action at the %1$s and %2$s directories, and be sure to spend a few minutes <a href="%3$s">configuring user profiles</a>. Want to explore more of BP&#8217;s features? Visit the <a href="%4$s">Components panel</a>.', 'buddypress' ),
@@ -585 +588 @@
                                 </div>
 
-                                <div class="return-to-dashboard">
-                                        <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
-                                </div>
+                                <?php if ( current_user_can( $this->capability ) ) :?>
+                                        <div class="return-to-dashboard">
+                                                <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
+                                        </div>
+                                <?php endif ;?>
 
                         </div>
@@ -716 +721 @@
                         </p>
 
-                        <div class="return-to-dashboard">
-                                <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
-                        </div>
+                        <?php if ( current_user_can( $this->capability ) ) :?>
+                                <div class="return-to-dashboard">
+                                        <a href="<?php echo esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) ); ?>"><?php _e( 'Go to the BuddyPress Settings page', 'buddypress' ); ?></a>
+                                </div>
+                        <?php endif;?>
 
                 </div>