process_members_type_updte not checking for 1edit_users' capability

[Venutius]

Whislt checking the permission checks in buddypress/bp-members/classes/class-bp-members-admin.php I came across line 1228 which seems to omit the capability check for 'edit_users':

if ( ! bp_current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {

I think this should be changed to:

if ( ! current_user_can( 'edit_users' ) && ! bp_current_user_can( 'bp_moderate' ) && $user_id != bp_loggedin_user_id() ) {

[imath]

Hi,

I'd like to see a patch about it, if this can happen, I'm fine with including it into 10.0.0

[dcavins]

In 13161:

In BP_Members_Admin, add checks for 'edit_users' capability.

BP_Members_Admin checks the bp_moderate
capability in several situations when
checking whether or not the user can
generally edit users is also a sensible check.

Props venutius.

Fixes #8070.
Fixes #8072.
Fixes #8073.