Changeset 8149

Timestamp:

03/20/2014 11:14:32 PM (11 years ago)

Author:

imath

Message:

In wp-admin/profile, be consistent with front-end when BuddyPress is not network activated

In this specific config, on front-end, the regular Admin :

• can edit members profile,
• cannot edit a Super Admin profile,
• cannot mark as spam a user.

We need to make sure, this is also the case in the wp-admin/profile screens.

See #5367

File:

• trunk/bp-members/bp-members-admin.php (modified) (4 diffs)

trunk/bp-members/bp-members-admin.php

@@ -312 +312 @@
 
         <ul id="profile-nav" class="nav-tab-wrapper">
-            <li class="nav-tab<?php echo esc_attr( $wp_active ); ?>"><a href="<?php echo esc_url( $wordpress_url );?>"><?php _e( 'WordPress Profile', 'buddypress' ); ?></a></li>
+            <?php 
+            /**
+             * In configs where BuddyPress is not network activated, as regular
+             * admins do not have the capacity to edit other users, we must add
+             * this check.
+             */
+            ?>
+            <?php if ( current_user_can( 'edit_user' ) ) :?>
+                <li class="nav-tab<?php echo esc_attr( $wp_active ); ?>"><a href="<?php echo esc_url( $wordpress_url );?>"><?php _e( 'WordPress Profile', 'buddypress' ); ?></a></li>
+            <?php endif ;?>
             <li class="nav-tab<?php echo esc_attr( $bp_active ); ?>"><a href="<?php echo esc_url( $community_url );?>"><?php _e( 'Community Profile', 'buddypress' ); ?></a></li>
 
@@ -623 +632 @@
 
                 <div id="misc-publishing-actions">
-                    <div class="misc-pub-section" id="comment-status-radio">
-                        <label class="approved"><input type="radio" name="user_status" value="ham" <?php checked( bp_is_user_spammer( $user->ID ), false ); ?>><?php esc_html_e( 'Active', 'buddypress' ); ?></label><br />
-                        <label class="spam"><input type="radio" name="user_status" value="spam" <?php checked( bp_is_user_spammer( $user->ID ), true ); ?>><?php esc_html_e( 'Spammer', 'buddypress' ); ?></label>
-                    </div>
+                    <?php
+                    /**
+                     * In configs where BuddyPress is not network activated, regular admins
+                     * cannot mark a user as a spammer on front end. This prevent them to do
+                     * it in backend.
+                     */
+                    ?>
+                    <?php if ( empty( $this->subsite_activated ) || ( ! empty( $this->subsite_activated ) && current_user_can( 'manage_network_users' ) ) ) : ?>
+                        <div class="misc-pub-section" id="comment-status-radio">
+                            <label class="approved"><input type="radio" name="user_status" value="ham" <?php checked( bp_is_user_spammer( $user->ID ), false ); ?>><?php esc_html_e( 'Active', 'buddypress' ); ?></label><br />
+                            <label class="spam"><input type="radio" name="user_status" value="spam" <?php checked( bp_is_user_spammer( $user->ID ), true ); ?>><?php esc_html_e( 'Spammer', 'buddypress' ); ?></label>
+                        </div>
+                    <?php endif ;?>
 
                     <div class="misc-pub-section curtime misc-pub-section-last">
@@ -723 +741 @@
         }
 
+        // Prevent a regular admin to edit a super admin
+        if( in_array( $user->user_login, get_super_admins() ) ) {
+            return $actions;
+        }
+
         $edit_profile = add_query_arg( array(
             'user_id'         => $user->ID,
@@ -728 +751 @@
         ), $this->edit_profile_url );
 
-        $edit_action = $actions['edit'];
-        unset( $actions['edit'] );
-
-        $new_edit_actions = array(
-            'edit'         => $edit_action,
-            'edit-profile' => '<a href="' . esc_url( $edit_profile ) . '">' . esc_html__( 'Profile', 'buddypress' ) . '</a>'
-        );
+        $edit_profile_link = '<a href="' . esc_url( $edit_profile ) . '">' . esc_html__( 'Profile', 'buddypress' ) . '</a>';
+
+        /**
+         * Check the edit action is available
+         * and preserve the order edit | profile | remove/delete
+         */
+        if ( ! empty( $actions['edit'] ) ) {
+            $edit_action = $actions['edit'];
+            unset( $actions['edit'] );
+ 
+            $new_edit_actions = array(
+                'edit'         => $edit_action,
+                'edit-profile' => $edit_profile_link,
+            );
+        // if not available simply add the edit profile action
+        } else {
+            $new_edit_actions = array( 'edit-profile' => $edit_profile_link );
+        }
 
         return array_merge( $new_edit_actions, $actions );