About BuddyPress in WP Admin Bar and multisite config !!

[imath]

On multisite config, BuddyPress Network activated.

1. a regular Administrator of the root_blog can from the administration of this root blog click on the WP Admin Bar "About BuddyPress" link to discover the about page and :
   • the BuddyPress settings menu !! from which he can deactivate the components, change the page mapping, and edit all BuddyPress settings
   • the BuddyPress tools menu, from which he can hopefully do nothing :)

2. a regular Administrator of a child blog sees the same link, hopefully on click, he has the wp_die() message

So i think it's really important to :
a) avoid showing the About link in th WP Admin Bar on child blogs.
b) create a specific capability like 'bp_admin' that is mapped to 'manage_options' if ! multisite() and to 'manage_network_options' in case of a multisite config where BuddyPress is network activated. I think i'll create a new ticket for this last one.

The patch only disable the About WP Admin Link on child blogs.

[johnjamesjacoby]

Let's choose our capability names wisely, especially since they are currently being done piecemeal. bp_moderate was picked specifically as a replacement for our is_super_admin checks of yore.

I agree there are some single/multi-site quirks with activation and admin screens. Let's try to make wise decisions about what we ultimately want users and admins to see. Our adding a menu for About BuddyPress has always felt over-the-top to me, since it's an admin screen, and we typically want to keep members out of the admin area.

[imath]

Replying to johnjamesjacoby:

Let's choose our capability names wisely, especially since they are currently being done piecemeal. bp_moderate was picked specifically as a replacement for our is_super_admin checks of yore.

I agree, i found this bug after having troubles with bp_moderate and configs where BuddyPress is not network activated. Because in this case, a regular admin has the same power than a super admin see #5463

[boonebgorges]

The real issue is not that we're showing the link to About BuddyPress to non-super-admins, it's that we're allowing people to see screens and change info that they shouldn't be allowed to change. If we don't want non-super-admins to see our Settings and Tools pages, then we should be bouncing them directly from those pages. *That* is the blocker issue. If we want to hide the About BuddyPress link from certain people, that's fine too.

[imath]

Replying to boonebgorges:

The real issue is not that we're showing the link to About BuddyPress to non-super-admins, it's that we're allowing people to see screens and change info that they shouldn't be allowed to change.

I agree. The cause that opens the problem is the "About BuddyPress" WP Admin Bar link. So a quick fix is to hide it.

A real fix might be to use a capability so that we're sure using it for a menu (for example) will ensure the menu would only be showed to allowed users. It could be 'bp_moderate' if the mapping function was more strict, else a new capability ( 'bp_admin' or 'bp_manage' or 'manage_buddypress'...) that would allow 'manage_options' if single config and 'manage_network_options' if on multisite would be interesting, i think.

[imath]

Hi,

a good night of sleep can be a good advisor :) Maybe we could just like the settings page use the setup_globals() method of the BP_Admin class to set the capability based on bp_core_do_network_admin().

That can avoid the creation of a new 'admin' capacity.

I've tested 5465.02.diff and it seems to fix the issue.

[boonebgorges]

imath - Excellent. 5465.02.diff looks like the right solution. In the situation where BP is activated on a single site in a network (so do_network_admin = false), I think it's correct that 'manage_options' is the right cap - that site's admin should be able to access settings. Thanks for the research.

[imath]

In 8139:

Check the right capabilities are used in the BP_Admin class

The introduction of the link "About BuddyPress" within the WP Admin Bar revealed that in multisite configurations, some administration menus were accessible to regular administrators when they should be restricted to the Super Administrator.
Now, the capacity used in these menus will be adapted to the configuration in which BuddyPress evolves using a "network" capacity when necessary.

props johnjamesjacoby, boonebgorges, imath

See #5465

[imath]

In 8140:

Check the right capabilities are used in the BP_Admin class

The introduction of the link "About BuddyPress" within the WP Admin Bar revealed that in multisite configurations, some administration menus were accessible to regular administrators when they should be restricted to the Super Administrator.
Now, the capacity used in these menus will be adapted to the configuration in which BuddyPress evolves using a "network" capacity when necessary.

props johnjamesjacoby, boonebgorges, imath

Fixes #5465

[boonebgorges]

Moving to 2.0 because 1.9.3 never happened.