Changeset 8148

Timestamp:

03/20/2014 10:01:10 PM (12 years ago)

Author:

imath

Message:

Make sure Signups Management is restricted to Super Admin when BuddyPress is not network activated

On a multisite config, when BuddyPress is not network activated, we need to prevent a regular admin to access to the signups management screens as the different actions requires Super Admin privileges.

See #5374

File:

• trunk/bp-members/bp-members-admin.php (modified) (5 diffs)

trunk/bp-members/bp-members-admin.php

@@ -103 +103 @@
                 $this->js_url    = trailingslashit( $this->admin_url . 'js'  ); // Admin CSS URL
 
+                // Capability depends on config
+                $this->capability = bp_core_do_network_admin() ? 'manage_network_options' : 'manage_options';
+                
                 // The Edit Profile Screen id
                 $this->user_page = '';
@@ -123 +126 @@
                 $this->users_url    = bp_get_admin_url( 'users.php' );
                 $this->users_screen = bp_core_do_network_admin() ? 'users-network' : 'users';
+
+                // Specific config: BuddyPress is not network activated
+                $this->subsite_activated = (bool) is_multisite() && ! bp_is_network_activated();
+
+                // When BuddyPress is not network activated, only Super Admin can moderate signups
+                if ( ! empty( $this->subsite_activated ) ) {
+                        $this->capability = 'manage_network_options';
+                }
         }
 
@@ -152 +163 @@
                 /** Signups **************************************************************/
 
-                if ( bp_get_signup_allowed() ) {
-                        if ( ! is_multisite() && is_admin() ) {
+                if ( bp_get_signup_allowed() && is_admin() ) {
+                        if ( ! is_multisite() ) {
                                 add_action( 'pre_user_query', array( $this, 'remove_signups_from_user_query'),  10, 1 );
                         }
 
-                        // Reorganise the views navigation in users.php and signups page
-                        add_filter( "views_{$this->users_screen}", array( $this, 'signup_filter_view' ),    10, 1 );
-                        add_filter( 'set-screen-option',           array( $this, 'signup_screen_options' ), 10, 3 );
+                        if ( current_user_can( $this->capability ) ) {
+                                // Reorganise the views navigation in users.php and signups page
+                                add_filter( "views_{$this->users_screen}", array( $this, 'signup_filter_view' ),    10, 1 );
+                                add_filter( 'set-screen-option',           array( $this, 'signup_screen_options' ), 10, 3 );
+                        }
                 }
         }
@@ -182 +195 @@
                 );
 
-                $hooks['signups'] = $this->users_page = add_users_page(
+                $hooks['signups'] = $this->signups_page = add_users_page(
                         __( 'Manage Signups',  'buddypress' ),
                         __( 'Manage Signups',  'buddypress' ),
-                        'bp_moderate',
+                        $this->capability,
                         'bp-signups',
                         array( &$this, 'signups_admin' )
@@ -203 +216 @@
 
                 foreach ( $hooks as $key => $hook ) {
-                        add_action( "load-$hook",       array( $this, $key . '_admin_load' ) );
+                        add_action( "load-$hook", array( $this, $key . '_admin_load' ) );
                 }