Changeset 8149

Timestamp:

03/20/2014 11:14:32 PM (12 years ago)

Author:

imath

Message:

In wp-admin/profile, be consistent with front-end when BuddyPress is not network activated

In this specific config, on front-end, the regular Admin :

• can edit members profile,
• cannot edit a Super Admin profile,
• cannot mark as spam a user.

We need to make sure, this is also the case in the wp-admin/profile screens.

See #5367

File:

• trunk/bp-members/bp-members-admin.php (modified) (4 diffs)

trunk/bp-members/bp-members-admin.php

@@ -312 +312 @@
 
                 <ul id="profile-nav" class="nav-tab-wrapper">
-                        <li class="nav-tab<?php echo esc_attr( $wp_active ); ?>"><a href="<?php echo esc_url( $wordpress_url );?>"><?php _e( 'WordPress Profile', 'buddypress' ); ?></a></li>
+                        <?php 
+                        /**
+                         * In configs where BuddyPress is not network activated, as regular
+                         * admins do not have the capacity to edit other users, we must add
+                         * this check.
+                         */
+                        ?>
+                        <?php if ( current_user_can( 'edit_user' ) ) :?>
+                                <li class="nav-tab<?php echo esc_attr( $wp_active ); ?>"><a href="<?php echo esc_url( $wordpress_url );?>"><?php _e( 'WordPress Profile', 'buddypress' ); ?></a></li>
+                        <?php endif ;?>
                         <li class="nav-tab<?php echo esc_attr( $bp_active ); ?>"><a href="<?php echo esc_url( $community_url );?>"><?php _e( 'Community Profile', 'buddypress' ); ?></a></li>
 
@@ -623 +632 @@
 
                                 <div id="misc-publishing-actions">
-                                        <div class="misc-pub-section" id="comment-status-radio">
-                                                <label class="approved"><input type="radio" name="user_status" value="ham" <?php checked( bp_is_user_spammer( $user->ID ), false ); ?>><?php esc_html_e( 'Active', 'buddypress' ); ?></label><br />
-                                                <label class="spam"><input type="radio" name="user_status" value="spam" <?php checked( bp_is_user_spammer( $user->ID ), true ); ?>><?php esc_html_e( 'Spammer', 'buddypress' ); ?></label>
-                                        </div>
+                                        <?php
+                                        /**
+                                         * In configs where BuddyPress is not network activated, regular admins
+                                         * cannot mark a user as a spammer on front end. This prevent them to do
+                                         * it in backend.
+                                         */
+                                        ?>
+                                        <?php if ( empty( $this->subsite_activated ) || ( ! empty( $this->subsite_activated ) && current_user_can( 'manage_network_users' ) ) ) : ?>
+                                                <div class="misc-pub-section" id="comment-status-radio">
+                                                        <label class="approved"><input type="radio" name="user_status" value="ham" <?php checked( bp_is_user_spammer( $user->ID ), false ); ?>><?php esc_html_e( 'Active', 'buddypress' ); ?></label><br />
+                                                        <label class="spam"><input type="radio" name="user_status" value="spam" <?php checked( bp_is_user_spammer( $user->ID ), true ); ?>><?php esc_html_e( 'Spammer', 'buddypress' ); ?></label>
+                                                </div>
+                                        <?php endif ;?>
 
                                         <div class="misc-pub-section curtime misc-pub-section-last">
@@ -723 +741 @@
                 }
 
+                // Prevent a regular admin to edit a super admin
+                if( in_array( $user->user_login, get_super_admins() ) ) {
+                        return $actions;
+                }
+
                 $edit_profile = add_query_arg( array(
                         'user_id'         => $user->ID,
@@ -728 +751 @@
                 ), $this->edit_profile_url );
 
-                $edit_action = $actions['edit'];
-                unset( $actions['edit'] );
-
-                $new_edit_actions = array(
-                        'edit'         => $edit_action,
-                        'edit-profile' => '<a href="' . esc_url( $edit_profile ) . '">' . esc_html__( 'Profile', 'buddypress' ) . '</a>'
-                );
+                $edit_profile_link = '<a href="' . esc_url( $edit_profile ) . '">' . esc_html__( 'Profile', 'buddypress' ) . '</a>';
+
+                /**
+                 * Check the edit action is available
+                 * and preserve the order edit | profile | remove/delete
+                 */
+                if ( ! empty( $actions['edit'] ) ) {
+                        $edit_action = $actions['edit'];
+                        unset( $actions['edit'] );
+ 
+                        $new_edit_actions = array(
+                                'edit'         => $edit_action,
+                                'edit-profile' => $edit_profile_link,
+                        );
+                // if not available simply add the edit profile action
+                } else {
+                        $new_edit_actions = array( 'edit-profile' => $edit_profile_link );
+                }
 
                 return array_merge( $new_edit_actions, $actions );