Group activities on group's home : only the activities the logged in user posted are displayed

[imath]

In version 2.1, the super admin was able to view the activities of an hidden/private group even if he wasn't a part of. It's no more the case.

Actually, after using different user logins, the problem seems to be : in the case of private/hidden groups only the activities of the current logged in user are displayed.

I think we really need to fix this as it's a regression.

[imath]

Actually no matter the group status. Only the activities the logged in user posted are displayed.

[boonebgorges]

6169.diff​ is a conservative patch that checks against the same scope whitelist as in 2.1.

A more correct fix, IMO, is to remove this bit from bp_has_activities() altogether, and move it into individual scope_args filters. I'm guessing this was not done initially to avoid lots of repetition. But as things stand, we're parsing scope in two different places, and besides this bug, it also makes debugging more complex.

[r-a-y]

02.patch follows the recommendations in comment:5 and passes imath's unit test.

Something to note, right now for the sitewide visibility, we check the passed user ID against the logged-in user, but in a future release, we could probably also check if the logged-in user has the 'bp_moderate' cap. That way, BP mods can view hidden content directly on a user's profile.

[imath]

thanks a lot for your patch r-a-y. Just tested it, and i confirm it's fixing the issue

[boonebgorges]

This patch looks like the right fix. I'm glad we'll ship 2.2 with this fix, as it makes the whole system make a lot more sense (IMHO).

[johnjamesjacoby]

In 9405:

Add unit tests for bp_has_activities() to test results with different group privacies. Props imath. See #6169.

[johnjamesjacoby]

In 9406:

Move $user_id abstraction out of bp_get_activities() and into their respective scope filters.

This fixes a regression from Activity Query scope improvements causing private and hidden group activity queries to intersect with user ID's, resulting in unexpected activity stream items being displayed.

Tests included in r9405.

Props r-a-y. Fixes #6169.