diff --git src/bp-members/bp-members-admin.php src/bp-members/bp-members-admin.php index 9af10b5..4160707 100644 --- src/bp-members/bp-members-admin.php +++ src/bp-members/bp-members-admin.php @@ -108,17 +108,23 @@ class BP_Members_Admin { // The Edit Profile Screen id $this->user_page = ''; + // The Show Profile Screen id + $this->user_profile = bp_current_user_can( 'bp_moderate' ) ? 'users' : 'profile'; + $this->is_self_profile = false; + + // The current user id + $this->current_user_id = get_current_user_id(); + // The screen ids to load specific css for $this->screen_id = array(); // The stats metabox default position $this->stats_metabox = new StdClass(); - // The WordPress edit user url - $this->edit_url = bp_get_admin_url( 'user-edit.php' ); - - // BuddyPress edit user's profile url - $this->edit_profile_url = add_query_arg( 'page', 'bp-profile-edit', bp_get_admin_url( 'users.php' ) ); + // BuddyPress edit user's profile args + $this->edit_profile_args = array( 'page' => 'bp-profile-edit' ); + $this->edit_profile_url = ''; + $this->edit_url = ''; // Data specific to signups $this->users_page = ''; @@ -151,14 +157,25 @@ class BP_Members_Admin { // Add menu item to all users menu add_action( bp_core_admin_hook(), array( $this, 'admin_menus' ), 5 ); + // In multisite we'll use this hook to be sure every member + // can access their wp-admin/extended profile + add_action( 'user_admin_menu', array( $this, 'user_profile_menu' ), 5 ); + // Enqueue all admin JS and CSS add_action( 'bp_admin_enqueue_scripts', array( $this, 'enqueue_scripts' ) ); // Create the Profile Navigation (Profile/Extended Profile) add_action( 'edit_user_profile', array( $this, 'profile_nav' ), 99, 1 ); + add_action( 'show_user_profile', array( $this, 'profile_nav' ), 99, 1 ); // Add a row action to users listing - add_filter( bp_core_do_network_admin() ? 'ms_user_row_actions' : 'user_row_actions', array( $this, 'row_actions' ), 10, 2 ); + if ( bp_core_do_network_admin() ) { + add_filter( 'ms_user_row_actions', array( $this, 'row_actions' ), 10, 2 ); + add_action( 'admin_init', array( $this, 'add_edit_profile_url_filter' ) ); + add_action( 'wp_after_admin_bar_render', array( $this, 'remove_edit_profile_url_filter' ) ); + } else { + add_filter( 'user_row_actions', array( $this, 'row_actions' ), 10, 2 ); + } /** Signups **************************************************************/ @@ -176,20 +193,49 @@ class BP_Members_Admin { } /** - * Create the All Users > Edit Profile and Signups submenus. + * Create the self admin Profile submenus for members. + * + * @access public + * @since BuddyPress (2.1.0) + * + * @uses add_submenu_page() To add the Edit Profile page in Profile section. + */ + public function user_profile_menu() { + $hooks['user'] = $this->user_page = add_submenu_page( + 'profile.php', + __( 'Edit Profile', 'buddypress' ), + __( 'Edit Profile', 'buddypress' ), + 'exist', + 'bp-profile-edit', + array( &$this, 'user_admin' ) + ); + + $this->screen_id = array( $this->user_page . '-user', $this->user_profile .'-user' ); + + foreach ( $hooks as $key => $hook ) { + add_action( "load-$hook", array( $this, $key . '_admin_load' ) ); + } + + add_action( "admin_head-$this->user_page", array( $this, 'profile_admin_head' ) ); + add_action( "admin_head-profile.php", array( $this, 'profile_admin_head' ) ); + } + + /** + * Create the All Users / Profile > Edit Profile and All Users Signups submenus. * * @access public * @since BuddyPress (2.0.0) * - * @uses add_users_page() To add the Edit Profile page in Users section. + * @uses add_submenu_page() To add the Edit Profile page in Users/Profile section. */ public function admin_menus() { // Manage user's profile - $hooks['user'] = $this->user_page = add_users_page( + $hooks['user'] = $this->user_page = add_submenu_page( + $this->user_profile . '.php', __( 'Edit Profile', 'buddypress' ), __( 'Edit Profile', 'buddypress' ), - 'bp_moderate', + 'read', 'bp-profile-edit', array( &$this, 'user_admin' ) ); @@ -203,38 +249,78 @@ class BP_Members_Admin { array( &$this, 'signups_admin' ) ); - $edit_page = 'user-edit'; - $this->users_page = 'users'; + $edit_page = 'user-edit'; + $profile_page = 'profile'; + $this->users_page = 'users'; + + // Self profile check is needed for this pages + $page_head = array( + $this->user_page, + $profile_page . '.php', + $this->users_page . '.php', + $edit_page . '.php', + ); if ( bp_core_do_network_admin() ) { $edit_page .= '-network'; $this->users_page .= '-network'; $this->user_page .= '-network'; + $profile_page .= '-network'; $this->signups_page .= '-network'; } - $this->screen_id = array( $edit_page, $this->user_page ); + $this->screen_id = array( $edit_page, $this->user_page, $profile_page ); foreach ( $hooks as $key => $hook ) { add_action( "load-$hook", array( $this, $key . '_admin_load' ) ); } - add_action( "admin_head-$this->user_page", array( $this, 'modify_admin_menu_highlight' ) ); + foreach ( $page_head as $head ) { + add_action( "admin_head-$head", array( $this, 'profile_admin_head' ) ); + } } /** * Highlight the Users menu if on Edit Profile. - * + * + * + Check if on the user's admin profile + * * @access public - * @since BuddyPress (2.0.0) + * @since BuddyPress (2.1.0) */ - public function modify_admin_menu_highlight() { + public function profile_admin_head() { global $plugin_page, $submenu_file; + // Is the user editing his profile ? + if ( defined( 'IS_PROFILE_PAGE' ) && IS_PROFILE_PAGE ) { + $this->is_self_profile = true; + } else if ( ! empty( $_GET['user_id'] ) ) { + $this->is_self_profile = $_GET['user_id'] == $this->current_user_id ? true : false ; + } + + $users_page = $this->user_profile . '.php'; + $edit_page = 'user-edit.php'; + + if ( ! empty( $this->is_self_profile ) ) { + $edit_page = 'profile.php'; + } + + // Super Admins on bp_core_do_network_admin() configs and all users for other ones + if ( ! is_user_admin() ) { + $this->edit_profile_url = add_query_arg( $this->edit_profile_args, bp_get_admin_url( $users_page ) ); + $this->edit_url = bp_get_admin_url( $edit_page ); + + // On multisite configs, using user_admin_url will display the extended profile for each member + // This is possible thanks to $this->filter_adminbar_profile_link() filter + } else { + $this->edit_profile_url = add_query_arg( $this->edit_profile_args, user_admin_url( $users_page ) ); + $this->edit_url = user_admin_url( $edit_page ); + } + // Only Show the All users menu - if ( $plugin_page = 'bp-profile-edit' ) { - $submenu_file = 'users.php'; + if ( $plugin_page == 'bp-profile-edit' ) { + $submenu_file = ! bp_core_do_network_admin() && ! empty( $this->is_self_profile ) ? 'profile.php' : $users_page; } } @@ -249,8 +335,8 @@ class BP_Members_Admin { * @since BuddyPress (2.0.0) */ public function admin_head() { - // Remove submenu to force using Profile Navigation remove_submenu_page( 'users.php', 'bp-profile-edit' ); + remove_submenu_page( 'profile.php', 'bp-profile-edit' ); } /** Community Profile ************************************************/ @@ -284,6 +370,24 @@ class BP_Members_Admin { } /** + * Should we display the profile nav in this admin area ? + * + * @access public + * @since BuddyPress (2.1.0) + */ + public function do_profile_nav() { + $retval = false; + + if ( bp_core_do_network_admin() ) { + $retval = is_user_admin() ? is_user_admin() : is_network_admin(); + } else { + $retval = is_admin(); + } + + return $retval; + } + + /** * Create the Profile navigation in Edit User & Edit Profile pages. * * @access public @@ -297,7 +401,7 @@ class BP_Members_Admin { // Don't display here if this is not where other BP // administration takes place - if ( bp_core_do_network_admin() && ! is_network_admin() ) { + if ( ! $this->do_profile_nav() ) { return; } @@ -310,6 +414,10 @@ class BP_Members_Admin { $community_url = add_query_arg( $query_args, $this->edit_profile_url ); $wordpress_url = add_query_arg( $query_args, $this->edit_url ); + if ( $this->is_self_profile ) { + $wordpress_url = remove_query_arg( 'user_id', $wordpress_url ); + } + $bp_active = false; $wp_active = ' nav-tab-active'; if ( 'BuddyPress' === $active ) { @@ -325,7 +433,7 @@ class BP_Members_Admin { * this check. */ ?> - + is_self_profile ) || current_user_can( 'edit_user' ) ) :?>
    • @@ -337,6 +445,38 @@ class BP_Members_Admin { } /** + * Can the current user edit the one displayed + * + * self profile editing / or bp_moderate check. + * This might be replaced by more granular capabilities + * in the future. + * + * @access public + * @since BuddyPress (2.1.0) + */ + public function member_can_edit( $user_id = 0 ) { + $retval = false; + + if ( empty( $user_id ) ) + return $retval; + + if ( $this->current_user_id == $user_id ) { + $retval = true; + + } else { + // Make sure a regular admin cannot edit a Super Admin + if ( is_super_admin( $user_id ) ) { + $retval = false; + // Default to bp_moderate + } else { + $retval = bp_current_user_can( 'bp_moderate' ); + } + } + + return $retval; + } + + /** * Set up the user's profile admin page. * * Loaded before the page is rendered, this function does all initial @@ -347,14 +487,16 @@ class BP_Members_Admin { * @since BuddyPress (2.0.0) */ public function user_admin_load() { - if ( ! $user_id = intval( $_GET['user_id'] ) ) { wp_die( __( 'No users were found', 'buddypress' ) ); } - // only edit others profile - if ( get_current_user_id() == $user_id ) { - bp_core_redirect( get_edit_user_link( $user_id ) ); + // Used for custom metabox and to disallow spam/unspam actions + $self_profile = $user_id == $this->current_user_id ? true : false; + + // can current user edit this profile ? + if ( ! $this->member_can_edit( $user_id ) ) { + wp_die( __( 'You cannot edit the requested user.', 'buddypress' ) ); } // Build redirection URL @@ -417,15 +559,21 @@ class BP_Members_Admin { // User Stat metabox add_meta_box( 'bp_members_admin_user_stats', _x( 'Stats' . $display_name, 'members user-admin edit screen', 'buddypress' ), array( &$this, 'user_admin_stats_metabox' ), get_current_screen()->id, sanitize_key( $this->stats_metabox->context ), sanitize_key( $this->stats_metabox->priority ) ); - // Custom metabox ? - do_action( 'bp_members_admin_user_metaboxes' ); + /** + * Custom metabox ? + * Plugins can restrict metabox to "bp_moderate" admins checking + * the first argument ($self_profile) is false in their hook + * They can also restruct their metabox to self profile editing + * by cheking it set to true. + */ + do_action( 'bp_members_admin_user_metaboxes', $self_profile, $user_id ); // Enqueue javascripts wp_enqueue_script( 'postbox' ); wp_enqueue_script( 'dashboard' ); // Spam or Ham user - } else if ( in_array( $doaction, array( 'spam', 'ham' ) ) ) { + } else if ( in_array( $doaction, array( 'spam', 'ham' ) ) && empty( $self_profile ) ) { check_admin_referer( 'edit-bp-profile_' . $user_id ); @@ -455,16 +603,24 @@ class BP_Members_Admin { */ public function user_admin() { - if ( ! current_user_can( 'bp_moderate' ) ) { + if ( ! current_user_can( 'bp_moderate' ) && empty( $this->is_self_profile ) ) { die( '-1' ); } $user = get_user_to_edit( $_GET['user_id'] ); + // Construct title + $title = __( 'Edit User', 'buddypress' ); + if ( ! empty( $this->is_self_profile ) ) { + $title = __( 'Profile', 'buddypress' ); + } + // Construct URL for form $form_url = remove_query_arg( array( 'action', 'error', 'updated', 'spam', 'ham' ), $_SERVER['REQUEST_URI'] ); $form_url = esc_url( add_query_arg( 'action', 'update', $form_url ) ); - $wp_http_referer = remove_query_arg( array( 'action', 'updated' ), $_REQUEST['wp_http_referer'] ); + $wp_http_referer = false; + if ( ! empty( $_REQUEST['wp_http_referer'] ) ) + $wp_http_referer = remove_query_arg( array( 'action', 'updated' ), $_REQUEST['wp_http_referer'] ); // Prepare notice for admin $notice = array(); @@ -556,12 +712,14 @@ class BP_Members_Admin {

    - - - - is_self_profile ) ) { + if ( current_user_can( 'create_users' ) ) { ?> + + + +

    @@ -631,17 +789,20 @@ class BP_Members_Admin {
    is_self_profile ) ) : /** * In configs where BuddyPress is not network activated, regular admins * cannot mark a user as a spammer on front end. This prevent them to do * it in backend. */ ?> - subsite_activated ) || ( ! empty( $this->subsite_activated ) && current_user_can( 'manage_network_users' ) ) ) : ?> -
    -
    - -
    + subsite_activated ) || ( ! empty( $this->subsite_activated ) && current_user_can( 'manage_network_users' ) ) ) : ?> +
    +
    + +
    +
    @@ -736,13 +897,9 @@ class BP_Members_Admin { * @return array Merged actions. */ public function row_actions( $actions = '', $user = null ) { - // only edit others profile - if ( get_current_user_id() == $user->ID ) { - return $actions; - } // Prevent a regular admin to edit a super admin - if( in_array( $user->user_login, get_super_admins() ) ) { + if( in_array( $user->user_login, get_super_admins() ) && $user->ID != $this->current_user_id ) { return $actions; } @@ -773,6 +930,41 @@ class BP_Members_Admin { return array_merge( $new_edit_actions, $actions ); } + /** + * Add a filter to edit profile url in WP Admin Bar + * + * @access public + * @since BuddyPress (2.1.0) + */ + public function add_edit_profile_url_filter() { + add_filter( 'bp_members_edit_profile_url', array( $this, 'filter_adminbar_profile_link' ), 10, 3 ); + } + + /** + * Filter the profile url + * + * @access public + * @since BuddyPress (2.1.0) + * + * @uses user_admin_url() + */ + public function filter_adminbar_profile_link( $profile_link = '', $url = '', $user_id = 0 ) { + if( ! is_super_admin( $user_id ) && is_admin() ) { + $profile_link = user_admin_url( 'profile.php' ); + } + return $profile_link; + } + + /** + * Remove the filter to edit profile url in WP Admin Bar + * + * @access public + * @since BuddyPress (2.1.0) + */ + public function remove_edit_profile_url_filter() { + remove_filter( 'bp_members_edit_profile_url', array( $this, 'filter_adminbar_profile_link' ), 10, 3 ); + } + /** Signups Management ***********************************************/ /**