Site membership requests: Create/change capability to approve requests

[leorospo]

An admin is not able to allow custom roles to approve ​site membership requests. This might be by design, however it would make sense to allow admins to have granular control over who can access the bp-signups tab in the user screen, and thus allow single users or custom roles to approve the site membership requests.

This can be accomplished by creating a new capability or by using bp_moderate to check for premission. At the moment the functionality is mapped to edit_users, and it might not be desired to allow for that as well.

<?php
// file: class-bp-members-admin.php
// line 109
$this->capability = bp_core_do_network_admin() ? 'manage_network_users' : 'edit_users';

// proposed change
$this->capability = bp_core_do_network_admin() ? 'manage_network_users' : 'bp_moderate';

[imath]

Hi @leorospo

Thanks for your feedback. Having granular community caps is something we've already thought of. It's a quite complex task but we're open to suggestions and patches or PRs. The bp_moderate might be too broad imho, because we use it a lot into our code base.

Related:
#7176
#5121

[dcavins]

I agree entirely with this, though I'm with @imath that bp_moderate is too broad. Ideally, the cap would be manage_membership_requests and we'll map it to a meta cap (like bp_moderate or edit_users) and leave maximum flexibility. I'm happy to move this logic into a meta_caps filter function.

[imath]

Great idea @dcavins let’s do this!

[dcavins]

I'm not going to get this built for v14.

[dcavins]

BP Members Admin: Use a BP-specific capability which is then mapped to the correct network or single-site edit user cap. This allows plugins to catch and set their own caps for our specific capability.

[dcavins]

Replace generic calls to bp_user_can( 'bp_moderate' ) with more specific capability checks when possible. We fall back to bp_moderate still, but this allows plugins to handle these cases in more specific ways if desired.

[espellcaste]

@dcavins Are those patches good for 15? Or should we postpone this ticket?

[dcavins]

I can commit the small one tonight. Thanks!

[dcavins]

In 14080:

BP Members Admin: Introduce new capability.

BP Members Admin: Use a BP-specific capability for whether a user can manage users and membership requests, which is then mapped to the common network or single-site edit user cap. This allows plugins to catch and set their own caps for our specific capability.

See #8794.

[dcavins]

@espellcaste The second patch is larger and we'll revisit it, so I'll change the version tag. Thanks!

[espellcaste]

@dcavins Sounds good. Just to confirm, what's the current status of this ticket? Pending more tests?

[dcavins]

Hi Renato, the larger patch is pending a second opinion, really. Thanks!