Changeset 8148 for trunk/bp-members/bp-members-admin.php

Timestamp:

03/20/2014 10:01:10 PM (11 years ago)

Author:

imath

Message:

Make sure Signups Management is restricted to Super Admin when BuddyPress is not network activated

On a multisite config, when BuddyPress is not network activated, we need to prevent a regular admin to access to the signups management screens as the different actions requires Super Admin privileges.

See #5374

File:

• trunk/bp-members/bp-members-admin.php (modified) (5 diffs)

trunk/bp-members/bp-members-admin.php

@@ -103 +103 @@
         $this->js_url    = trailingslashit( $this->admin_url . 'js'  ); // Admin CSS URL
 
+        // Capability depends on config
+        $this->capability = bp_core_do_network_admin() ? 'manage_network_options' : 'manage_options';
+        
         // The Edit Profile Screen id
         $this->user_page = '';
@@ -123 +126 @@
         $this->users_url    = bp_get_admin_url( 'users.php' );
         $this->users_screen = bp_core_do_network_admin() ? 'users-network' : 'users';
+
+        // Specific config: BuddyPress is not network activated
+        $this->subsite_activated = (bool) is_multisite() && ! bp_is_network_activated();
+
+        // When BuddyPress is not network activated, only Super Admin can moderate signups
+        if ( ! empty( $this->subsite_activated ) ) {
+            $this->capability = 'manage_network_options';
+        }
     }
 
@@ -152 +163 @@
         /** Signups **************************************************************/
 
-        if ( bp_get_signup_allowed() ) {
-            if ( ! is_multisite() && is_admin() ) {
+        if ( bp_get_signup_allowed() && is_admin() ) {
+            if ( ! is_multisite() ) {
                 add_action( 'pre_user_query', array( $this, 'remove_signups_from_user_query'),  10, 1 );
             }
 
-            // Reorganise the views navigation in users.php and signups page
-            add_filter( "views_{$this->users_screen}", array( $this, 'signup_filter_view' ),    10, 1 );
-            add_filter( 'set-screen-option',           array( $this, 'signup_screen_options' ), 10, 3 );
+            if ( current_user_can( $this->capability ) ) {
+                // Reorganise the views navigation in users.php and signups page
+                add_filter( "views_{$this->users_screen}", array( $this, 'signup_filter_view' ),    10, 1 );
+                add_filter( 'set-screen-option',           array( $this, 'signup_screen_options' ), 10, 3 );
+            }
         }
     }
@@ -182 +195 @@
         );
 
-        $hooks['signups'] = $this->users_page = add_users_page(
+        $hooks['signups'] = $this->signups_page = add_users_page(
             __( 'Manage Signups',  'buddypress' ),
             __( 'Manage Signups',  'buddypress' ),
-            'bp_moderate',
+            $this->capability,
             'bp-signups',
             array( &$this, 'signups_admin' )
@@ -203 +216 @@
 
         foreach ( $hooks as $key => $hook ) {
-            add_action( "load-$hook",       array( $this, $key . '_admin_load' ) );
+            add_action( "load-$hook", array( $this, $key . '_admin_load' ) );
         }