Changeset 8605 for trunk/src/bp-groups/bp-groups-classes.php

Timestamp:

07/12/2014 01:26:36 AM (12 years ago)

Author:

boonebgorges

Message:

Overhaul access and visibility control for group tabs

Previously, access control to group tabs was handled in two ways:

• for BP_Group_Extension tabs, the 'enable_nav_item' and 'visibility' provided some control over access to plugin developers, though it was inconsistent, buggy, and difficult to implement properly
• for tabs provided by bp-groups, access to the tabs of non-public groups was controlled directly in the BP_Groups_Component::setup_globals() method

Aside from being unclear for developers, this technique for controlling access
was also inflexible. For non-public groups, tab access was hardcoded and
handled before BP_Group_Extension plugins even had a chance to load. As a
result, it was essentially impossible to add public tabs to non-public groups
(among other non-standard customizations).

The current changeset comprises a number of changes that make tab access more
consistent and flexible:

• Access control is moved to the new bp_groups_group_access_protection() function. This function has the necessary filters to customize access protection in arbitrary ways. And because it loads at 'bp_actions' - just before the page begins to render - all extensions have had a chance to load and register themselves with the desired access settings.
• The 'visibility' and 'enable_nav_item' properties of BP_Group_Extension are phased out in favor of 'access' and 'show_tab' params. 'access' controls who can visit the tab, while 'show_tab' controls who can see the item in the navigation. These new properties have intelligent defaults (based on the privacy level of the group), but can be overridden with a number of custom settings: 'admin', 'mod', 'member', 'loggedin', 'anyone', or 'noone'. Backward compatibility is maintained, so that existing BP_Group_Extension plugins that use enable_nav_item or visibility will continue to work as before.

Fixes #4785

Props boonebgorges, dcavins, imath

File:

• trunk/src/bp-groups/bp-groups-classes.php (modified) (8 diffs)

trunk/src/bp-groups/bp-groups-classes.php

@@ -2881 +2881 @@
 
         /**
+         * Raw config params, as passed by the extending class.
+         *
+         * @since BuddyPress (2.1.0)
+         * @var array
+         */
+        public $params_raw = array();
+
+        /**
          * The ID of the current group.
          *
@@ -2922 +2930 @@
          */
         public $enable_nav_item = true;
+
+        /**
+         * Whether the current user should see the navigation item.
+         *
+         * @since BuddyPress (2.1.0)
+         * @var bool
+         */
+        public $user_can_see_nav_item;
+
+        /**
+         * Whether the current user can visit the tab.
+         *
+         * @since BuddyPress (2.1.0)
+         * @var bool
+         */
+        public $user_can_visit;
 
         /**
@@ -3061 +3085 @@
          */
         public function init( $args = array() ) {
+                // Store the raw arguments
+                $this->params_raw = $args;
 
                 // Before this init() method was introduced, plugins were
@@ -3081 +3107 @@
                         'template_file'     => $this->template_file,
                         'screens'           => $this->get_default_screens(),
+                        'access'            => null,
+                        'show_tab'          => null,
                 ) );
 
@@ -3123 +3151 @@
                 // Configure 'screens': create, admin, and edit contexts
                 $this->setup_screens();
+
+                // Configure access-related settings
+                $this->setup_access_settings();
 
                 // Mirror configuration data so it's accessible to plugins
@@ -3242 +3273 @@
         }
 
+        /**
+         * Set up access-related settings for this extension.
+         *
+         * @since BuddyPress (2.1.0)
+         */
+        protected function setup_access_settings() {
+                // Backward compatibility
+                if ( isset( $this->params['enable_nav_item'] ) ) {
+                        $this->enable_nav_item = (bool) $this->params['enable_nav_item'];
+                }
+
+                // Tab Access
+                $this->user_can_visit = false;
+
+                // Backward compatibility for components that do not provide
+                // explicit 'access' parameter
+                if ( empty( $this->params['access'] ) ) {
+                        if ( false === $this->enable_nav_item ) {
+                                $this->params['access'] = 'noone';
+                        } else {
+                                $group = groups_get_group( array(
+                                        'group_id' => $this->group_id,
+                                ) );
+
+                                if ( ! empty( $group->status ) && 'public' === $group->status ) {
+                                        // Tabs in public groups are accessible to anyone by default
+                                        $this->params['access'] = 'anyone';
+                                } else {
+                                        // All other groups have members-only as the default
+                                        $this->params['access'] = 'member';
+                                }
+                        }
+                }
+
+                // Parse multiple access conditions into an array
+                $access_conditions = $this->params['access'];
+                if ( ! is_array( $access_conditions ) ) {
+                        $access_conditions = explode( ',', $access_conditions );
+                }
+
+                // If the current user meets at least one condition, the
+                // get access
+                foreach ( $access_conditions as $access_condition ) {
+                        if ( $this->user_meets_access_condition( $access_condition ) ) {
+                                $this->user_can_visit = true;
+                                break;
+                        }
+                }
+
+                // Tab Visibility
+                $this->user_can_see_nav_item = false;
+
+                // Backward compatibility for components that do not provide
+                // explicit 'show_tab' parameter
+                if ( empty( $this->params['show_tab'] ) ) {
+                        if ( false === $this->params['enable_nav_item'] ) {
+                                // enable_nav_item is only false if it's been
+                                // defined explicitly as such in the
+                                // constructor. So we always trust this value
+                                $this->params['show_tab'] = 'noone';
+
+                        } else if ( isset( $this->params_raw['enable_nav_item'] ) || isset( $this->params_raw['visibility'] ) ) {
+                                // If enable_nav_item or visibility is passed,
+                                // we assume this  is a legacy extension.
+                                // Legacy behavior is that enable_nav_item=true +
+                                // visibility=private implies members-only
+                                if ( 'public' !== $this->visibility ) {
+                                        $this->params['show_tab'] = 'member';
+                                } else {
+                                        $this->params['show_tab'] = 'anyone';
+                                }
+
+                        } else {
+                                // No show_tab or enable_nav_item value is
+                                // available, so match the value of 'access'
+                                $this->params['show_tab'] = $this->params['access'];
+                        }
+                }
+
+                // Parse multiple access conditions into an array
+                $access_conditions = $this->params['show_tab'];
+                if ( ! is_array( $access_conditions ) ) {
+                        $access_conditions = explode( ',', $access_conditions );
+                }
+
+                // If the current user meets at least one condition, the
+                // get access
+                foreach ( $access_conditions as $access_condition ) {
+                        if ( $this->user_meets_access_condition( $access_condition ) ) {
+                                $this->user_can_see_nav_item = true;
+                                break;
+                        }
+                }
+        }
+
+        /**
+         * Check whether the current user meets an access condition.
+         *
+         * @param string $access_condition 'anyone', 'loggedin', 'member',
+         *        'mod', 'admin' or 'noone'.
+         * @return bool
+         */
+        protected function user_meets_access_condition( $access_condition ) {
+                $group = groups_get_group( array(
+                        'group_id' => $this->group_id,
+                ) );
+
+                switch ( $access_condition ) {
+                        case 'admin' :
+                                $meets_condition = groups_is_user_admin( bp_loggedin_user_id(), $this->group_id );
+                                break;
+
+                        case 'mod' :
+                                $meets_condition = groups_is_user_mod( bp_loggedin_user_id(), $this->group_id );
+                                break;
+
+                        case 'member' :
+                                $meets_condition = groups_is_user_member( bp_loggedin_user_id(), $this->group_id );
+                                break;
+
+                        case 'loggedin' :
+                                $meets_condition = is_user_logged_in();
+                                break;
+
+                        case 'noone' :
+                                $meets_condition = false;
+                                break;
+
+                        case 'anyone' :
+                        default :
+                                $meets_condition = true;
+                                break;
+                }
+
+                return $meets_condition;
+        }
+
         /** Display ***********************************************************/
 
@@ -3256 +3424 @@
                 }
 
-                // Bail if the current user doesn't have access
+                // Backward compatibility only
                 if ( ( 'public' !== $this->visibility ) && ! buddypress()->groups->current_group->user_has_access ) {
                         return;
                 }
 
-                if ( true === $this->enable_nav_item ) {
+                $user_can_see_nav_item = $this->user_can_see_nav_item();
+
+                if ( $user_can_see_nav_item ) {
+                        $group_permalink = bp_get_group_permalink( groups_get_current_group() );
+
                         bp_core_new_subnav_item( array(
                                 'name'            => ! $this->nav_item_name ? $this->name : $this->nav_item_name,
                                 'slug'            => $this->slug,
                                 'parent_slug'     => bp_get_current_group_slug(),
-                                'parent_url'      => bp_get_group_permalink( groups_get_current_group() ),
+                                'parent_url'      => $group_permalink,
                                 'position'        => $this->nav_item_position,
                                 'item_css_id'     => 'nav-' . $this->slug,
                                 'screen_function' => array( &$this, '_display_hook' ),
-                                'user_has_access' => $this->enable_nav_item
+                                'user_has_access' => $user_can_see_nav_item,
+                                'no_access_url'   => $group_permalink,
                         ) );
 
                         // When we are viewing the extension display page, set the title and options title
                         if ( bp_is_current_action( $this->slug ) ) {
+                                add_filter( 'bp_group_user_has_access',   array( $this, 'group_access_protection' ), 10, 2 );
                                 add_action( 'bp_template_content_header', create_function( '', 'echo "' . esc_attr( $this->name ) . '";' ) );
                                 add_action( 'bp_template_title',          create_function( '', 'echo "' . esc_attr( $this->name ) . '";' ) );
@@ -3293 +3467 @@
                 bp_core_load_template( apply_filters( 'bp_core_template_plugin', $this->template_file ) );
         }
+
+        /**
+         * Determine whether the current user should see this nav tab.
+         *
+         * Note that this controls only the display of the navigation item.
+         * Access to the tab is controlled by the user_can_visit() check.
+         *
+         * @since BuddyPress (2.1.0)
+         *
+         * @return bool
+         */
+        public function user_can_see_nav_item( $user_can_see_nav_item = false ) {
+                if ( 'noone' !== $this->params['show_tab'] && current_user_can( 'bp_moderate' ) ) {
+                        return true;
+                }
+
+                return $this->user_can_see_nav_item;
+        }
+
+        /**
+         * Determine whether the current user has access to visit this tab.
+         *
+         * @since BuddyPress (2.1.0)
+         *
+         * @return bool
+         */
+        public function user_can_visit( $user_can_visit = false ) {
+                if ( 'noone' !== $this->params['access'] && current_user_can( 'bp_moderate' ) ) {
+                        return true;
+                }
+
+                return $this->user_can_visit;
+        }
+
+        /**
+         * Filter the access check in bp_groups_group_access_protection() for this extension.
+         *
+         * Note that $no_access_args is passed by reference, as there are some
+         * circumstances where the bp_core_no_access() arguments need to be
+         * modified before the redirect takes place.
+         *
+         * @since BuddyPress (2.1.0)
+         *
+         * @param bool $user_can_visit
+         * @param array $no_access_args
+         * @return bool
+         */
+        public function group_access_protection( $user_can_visit, &$no_access_args ) {
+                $user_can_visit = $this->user_can_visit();
+
+                if ( ! $user_can_visit && is_user_logged_in() ) {
+                        $current_group = groups_get_group( array(
+                                'group_id' => $this->group_id,
+                        ) );
+
+                        $no_access_args['message'] = __( 'You do not have access to this content.', 'buddypress' );
+                        $no_access_args['root'] = bp_get_group_permalink( $current_group ) . 'home/';
+                        $no_access_args['redirect'] = false;
+                }
+
+                return $user_can_visit;
+        }
+
 
         /** Create ************************************************************/