Changeset 8942

Timestamp:

08/18/2014 01:15:40 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Improvements to Blogs & capabilities:

• Introduce bp_blogs_get_allowed_roles() to act as a blog-role whitelist
• Introduce bp_get_current_blog_roles() to avoid including an admin-only file theme-side
• Use these functions to clean-up the add_user_to_blog process in several ways:

More accurately match the member-to-blog relationship specification
No-subscriber users remains functionality intact
Allow extending of existing user-to-blog behavior

See #5749, #5819.

Location:

trunk/src

Files:

• bp-blogs/bp-blogs-functions.php (modified) (4 diffs)
• bp-blogs/bp-blogs-template.php (modified) (1 diff)
• bp-core/bp-core-caps.php (modified) (1 diff)

trunk/src/bp-blogs/bp-blogs-functions.php

@@ -768 +768 @@
  * parses the changes, and records them as necessary in the BP blog tracker.
  *
- * BuddyPress does not track blogs for Subscribers.
- *
- * @param int $user_id The ID of the user.
- * @param string|bool $role The WP role being assigned to the user
- *        ('subscriber', 'contributor', 'author', 'editor', 'administrator', or
- *        a custom role). Defaults to false.
- * @param int $blog_id Default: the current blog ID.
+ * BuddyPress does not track blogs for users with the 'subscriber' role by
+ * default, though as of 2.1.0 you can filter 'bp_blogs_get_allowed_roles' to
+ * modify this behavior.
+ *
+ * @param int         $user_id The ID of the user
+ * @param string|bool $role    User's WordPress role for this blog ID
+ * @param int         $blog_id Blog ID user is being added to
+ *
  * @return bool|null False on failure.
  */
 function bp_blogs_add_user_to_blog( $user_id, $role = false, $blog_id = 0 ) {
     global $wpdb;
-
-    require_once( ABSPATH . '/wp-admin/includes/user.php' );
 
     // If no blog ID was passed, use the root blog ID
@@ -792 +791 @@
         // Get user capabilities
         $key        = $wpdb->get_blog_prefix( $blog_id ). 'capabilities';
-        $user_roles = bp_get_user_meta( $user_id, $key, true );
+        $user_roles = array_keys( bp_get_user_meta( $user_id, $key, true ) );
 
         // User has roles so lets
         if ( ! empty( $user_roles ) ) {
 
-            // Look for blog only roles
-            $blog_roles = array_intersect(
-                array_keys( $user_roles ),
-                array_keys( get_editable_roles() )
-            );
+            // Get blog roles
+            $blog_roles      = array_keys( bp_get_current_blog_roles() );
+
+            // Look for blog only roles of the user
+            $intersect_roles = array_intersect( $user_roles, $blog_roles );
 
             // If there's a role in the array, use the first one. This isn't
@@ -807 +806 @@
             // WordPress does not yet have a UI for multiple user roles, it's
             // fine for now.
-            if ( ! empty( $blog_roles ) ) {
-                $role = array_shift( $blog_roles );
+            if ( ! empty( $intersect_roles ) ) {
+                $role = array_shift( $intersect_roles );
             }
         }
     }
 
-    // Bail if no role was found or user is a subscriber
-    if ( empty( $role ) || ( $role === 'subscriber' ) ) {
+    // Bail if no role was found or role is not in the allowed roles array
+    if ( empty( $role ) || ! in_array( $role, bp_blogs_get_allowed_roles() ) ) {
         return false;
     }
@@ -824 +823 @@
 add_action( 'profile_update',   'bp_blogs_add_user_to_blog'        );
 add_action( 'user_register',    'bp_blogs_add_user_to_blog'        );
+
+/**
+ * The allowed blog roles a member must have to be recorded into the
+ * `bp_user_blogs` pointer table.
+ *
+ * This added and was made filterable in BuddyPress 2.1.0 to make it easier
+ * to extend the functionality of the Blogs component.
+ *
+ * @since BuddyPress (2.1.0)
+ *
+ * @return string
+ */
+function bp_blogs_get_allowed_roles() {
+    return apply_filters( 'bp_blogs_get_allowed_roles', array( 'contributor', 'author', 'editor', 'administrator' ) );
+}
 
 /**

trunk/src/bp-blogs/bp-blogs-template.php

@@ -370 +370 @@
         'per_page'          => 20,
         'max'               => false,
-        'user_id'           => bp_displayed_user_id(), // Pass a user_id to limit to only blogs this user has higher than subscriber access to
+        'user_id'           => bp_displayed_user_id(), // Pass a user_id to limit to only blogs this user is a member of
         'include_blog_ids'  => false,
         'search_terms'      => $search_terms,          // Pass search terms to filter on the blog title or description.

trunk/src/bp-core/bp-core-caps.php

@@ -10 +10 @@
 // Exit if accessed directly
 if ( !defined( 'ABSPATH' ) ) exit;
+
+/**
+ * Return an array of roles from the currently loaded blog
+ *
+ * WordPress roles are dynamically flipped when calls to switch_to_blog() and
+ * restore_current_blog() are made, so we use and trust WordPress core to have
+ * loaded the correct results for us here. As enhancements are made to
+ * WordPresss's RBAC, so should our capability functions here.
+ *
+ * @since BuddyPress (2.1.0)
+ *
+ * @return array
+ */
+function bp_get_current_blog_roles() {
+    global $wp_roles;
+
+    // Sanity check on roles global variable
+    $roles = isset( $wp_roles->roles )
+        ? $wp_roles->roles
+        : array();
+
+    // Apply WordPress core filter to editable roles
+    $roles = apply_filters( 'editable_roles', $roles );
+
+    // Return the editable roles
+    return apply_filters( 'bp_get_current_blog_roles', $roles, $wp_roles );
+}
 
 /**