Pending invite cannot be removed from a group when friendship is cancelled

[jomisica]

There is a problem with group invitations. I'll explain how.

1 - I create a group
2 - I invite a friend
3 - Cancel the friendship with this friend, without him having accepted the invitation to the group

At this moment the invitation is pending in the group that can not be removed, except for the modification of the tables.

Notification of the invitation to the group is still in the user notification list however if he accepts the invitation he is not placed in the group because the friendship no longer exists.

I discovered this by accidentally canceling a friendship!

[r-a-y]

I cannot duplicate this with the steps listed above.

Are you using another plugin for invites such as Invite Anyone or something else?

If possible, can you write clearer steps as to how you invited a friend, how you cancelled the friendship request and how you are attempting to accept a group invite?

If taking screenshots or a screencast is easier, that would be great as well.

---

Notification of the invitation to the group is still in the user notification list however if he accepts the invitation he is not placed in the group because the friendship no longer exists.

Unread group invite notifications are always cleared when you visit your /members/me/groups/invites/ page.

The invited user is also able to accept the group invitation. Accepting or rejecting group invites does not rely on a friendship status check.

[jomisica]

Very well I recorded the screen when performing the steps.
​https://www.ncdc.pt/cache/Send-invites-Screencast-2018-03-28-02:19:56.mp4

The file is too large to send as an attachment, 18MB.

The last step to remove the invitation is that it does not work.

Sorry for my english from google!

[r-a-y]

Thanks for recording and uploading the video, @jomisica!

For those not viewing the video, here are the steps to duplicate:

0. Test on BuddyPress 2.9.3
1. User A adds User B as a friend
2. User B accepts User A's friendship request
3. User A navigates to a group that User B is not a member of
4. User A clicks on the group's "Send Invites" tab and invites User B
5. User A navigates to their own "Friends" tab and cancels friendship with User B
6. User A goes back to the group's "Send Invites" page and User B is still listed in the invites list
7. User A attempts to remove User B from the invites list, but cannot

It appears we restrict removing pending group invites to friends in the bp-legacy template AJAX callback. Haven't looked at Nouveau yet, but 01.patch should fix the issue for 2.9.3.

We should also maybe look to automatically remove pending group invites when a friendship has been withdrawn.

For trunk, there are some issues with the friendship incremented object caching that we added in #7436, which affects testing this ticket. Will update that ticket with some additional info.

[dcavins]

Hi @r-a-y-

I'm completely in favor of your proposed fix, but it does change the expected behavior by allowing people to invite non-friends to the group as well as being able to uninvite anyone. If this matters to anyone, I'll attach a patch that will keep the "friends" requirement but only apply it to the invitation creation process.

[dcavins]

Keep "friends" requirement for creating invitations; don't check when canceling an invite

[r-a-y]

Good point, dcavins.

I think removing the friends restriction would allow plugins to do as they please for group invites, which would be a good thing in my eyes.

That being said, I don't have any problems with 02.diff either.

Anyone else have any thoughts?

[DJPaul]

I think removing the "must be friends to invite to group" check would have significant impact on the UI and existing sites' expectations. We could have that discussion (please do!) but I think to get this bug fixed for 3.0, I think the 2.patch makes a lot of sense and it's elegant, keeping the same behaviour for invites/custom theme templates/etc.

@dcavins @r-a-y any objections? Would be nice to sneak this trunk for 3.0 if we have consensus.

[r-a-y]

I think removing the "must be friends to invite to group" check would have significant impact on the UI and existing sites' expectations.

Sure, but 01.patch only affects the AJAX call in bp-legacy and not the generation of the invites list.

Let's roll with the patch by @dcavins for now.

[DJPaul]

+1 :)

[r-a-y]

All yours, @dcavins!

[dcavins]

In 11969:

Allow pending invite to be cancelled without friendship requirement.

BP Legacy's function bp_legacy_theme_ajax_invite_user() was built to stop early if the invitee was not a friend of the inviter. In the case where you extend an invitation to a user, then cancel your friendship, you were prevented from running the uninvite task. This patch removes the friendship check from the uninvite task.

Props r-a-y.

Fixes #7726.