← All changes | includes/admin/users.php +27 -24 2.6.17 → 2.6.19 View file →

		@@ -15,9 +15,9 @@
15	15	* Loads bbPress users admin area
16	16	*
17	17	* @package bbPress
18	18	* @subpackage Administration
19		- * @since 2.0.0 bbPress (r2464)
	19	+ * @since 2.0.0 bbPress (r3095)
20	20	*/
21	21	class BBP_Users_Admin {
22	22
23	23	/**
		@@ -22,9 +22,9 @@
22	22
23	23	/**
24	24	* The bbPress users admin loader
25	25	*
26		- * @since 2.0.0 bbPress (r2515)
	26	+ * @since 2.0.0 bbPress (r3095)
27	27	*/
28	28	public function __construct() {
29	29	$this->setup_actions();
30	30	}
		@@ -31,9 +31,9 @@
31	31
32	32	/**
33	33	* Setup the admin hooks, actions and filters
34	34	*
35		- * @since 2.0.0 bbPress (r2646)
	35	+ * @since 2.0.0 bbPress (r3376)
36	36	*
37	37	* @access private
38	38	*/
39	39	private function setup_actions() {
		@@ -69,9 +69,10 @@
69	69
70	70	/**
71	71	* Default interface for setting a forum role
72	72	*
73		- * @since 2.2.0 bbPress (r4285)
	73	+ * @since 2.2.0 bbPress (r4301)
	74	+ * @since 2.6.19 bbPress (r7686) Show only assignable roles.
74	75	*
75	76	* @param WP_User $profileuser User data
76	77	* @return bool Always false
77	78	*/
		@@ -81,16 +82,11 @@
81	82	if ( ! current_user_can( 'edit_user', $profileuser->ID ) ) {
82	83	return;
83	84	}
84	85
85		- // Get the roles
86		- $dynamic_roles = bbp_get_dynamic_roles();
	86	+ // Get the roles this user may assign.
	87	+ $dynamic_roles = bbp_get_user_editable_forum_roles( $profileuser->ID ); ?>
87	88
88		- // Only keymasters can set other keymasters
89		- if ( ! bbp_is_user_keymaster() ) {
90		- unset( $dynamic_roles[ bbp_get_keymaster_role() ] );
91		- } ?>
92		-
93	89	<h2><?php esc_html_e( 'Forums', 'bbpress' ); ?></h2>
94	90
95	91	<table class="form-table">
96	92	<tbody>
		@@ -130,10 +126,11 @@
130	126
131	127	/**
132	128	* Add bulk forums role dropdown to the WordPress users table
133	129	*
134		- * @since 2.2.0 bbPress (r4360)
	130	+ * @since 2.2.0 bbPress (r4365)
135	131	* @since 2.6.0 bbPress (r6055) Introduced the `$which` parameter.
	132	+ * @since 2.6.19 bbPress (r7686) Show only assignable roles.
136	133	*
137	134	* @param string $which The location of the extra table nav markup: 'top' or 'bottom'.
138	135	*/
139	136	public static function user_role_bulk_dropdown( $which ) {
		@@ -149,15 +146,10 @@
149	146	return;
150	147	}
151	148
152	149	// Get the roles
153		- $dynamic_roles = bbp_get_dynamic_roles();
	150	+ $dynamic_roles = bbp_get_user_editable_forum_roles();
154	151
155		- // Only keymasters can set other keymasters
156		- if ( ! bbp_is_user_keymaster() ) {
157		- unset( $dynamic_roles[ bbp_get_keymaster_role() ] );
158		- }
159		-
160	152	$select_id = 'bottom' === $which ? 'bbp-new-role2' : 'bbp-new-role';
161	153	$button_id = 'bottom' === $which ? 'bbp-change-role2' : 'bbp-change-role';
162	154	?>
163	155
		@@ -176,8 +168,9 @@
176	168	* Process bulk dropdown form submission from the WordPress Users
177	169	* Table
178	170	*
179	171	* @since 2.2.0 bbPress (r4365)
	172	+ * @since 2.6.19 bbPress (r7686) Check each user and assignable role.
180	173	*
181	174	* @return bool Always false
182	175	*/
183	176	public function user_role_bulk_change() {
		@@ -199,8 +192,9 @@
199	192	$new_role = $_REQUEST['bbp-new-role'];
200	193	}
201	194
202	195	// Check that the new role exists
	196	+ $new_role = is_string( $new_role ) ? sanitize_text_field( wp_unslash( $new_role ) ) : '';
203	197	$dynamic_roles = bbp_get_dynamic_roles();
204	198	if ( ! $new_role || empty( $dynamic_roles[ $new_role ] ) ) {
205	199	return;
206	200	}
		@@ -224,17 +218,26 @@
224	218	if ( $user_id === $current_user_id ) {
225	219	continue;
226	220	}
227	221
	222	+ // Only change roles for users on this site who the current user may promote.
	223	+ if ( ! is_user_member_of_blog( $user_id ) || ! bbp_current_user_can_edit_user_field( 'forum_role', $user_id ) || ! current_user_can( 'promote_user', $user_id ) ) {
	224	+ continue;
	225	+ }
	226	+
228	227	// Set up user and role data
229	228	$user_role = bbp_get_user_role( $user_id );
230		- $new_role = sanitize_text_field( $new_role );
231	229
232		- // Only keymasters can set other keymasters
233		- if ( in_array( bbp_get_keymaster_role(), array( $user_role, $new_role ), true ) && ! bbp_is_user_keymaster() ) {
	230	+ // Check the roles allowed for this target user.
	231	+ if ( ! array_key_exists( $new_role, bbp_get_user_editable_forum_roles( $user_id ) ) ) {
234	232	continue;
235	233	}
236	234
	235	+ // Only keymasters and site administrators can change keymaster roles.
	236	+ if ( in_array( bbp_get_keymaster_role(), array( $user_role, $new_role ), true ) && ! bbp_is_user_keymaster() && ! current_user_can( 'manage_options' ) ) {
	237	+ continue;
	238	+ }
	239	+
237	240	// Set the new forums role
238	241	if ( $new_role !== $user_role ) {
239	242	bbp_set_user_role( $user_id, $new_role );
240	243	}
		@@ -266,9 +269,9 @@
266	269	/**
267	270	* Add Forum Role column to the WordPress Users table, and change the
268	271	* core role title to "Site Role"
269	272	*
270		- * @since 2.2.0 bbPress (r4337)
	273	+ * @since 2.2.0 bbPress (r4338)
271	274	*
272	275	* @param array $columns Users table columns
273	276	* @return array $columns
274	277	*/
		@@ -293,9 +296,9 @@
293	296
294	297	/**
295	298	* Return user's forums role for display in the WordPress Users list table
296	299	*
297		- * @since 2.2.0 bbPress (r4337)
	300	+ * @since 2.2.0 bbPress (r4338)
298	301	*
299	302	* @param string $retval
300	303	* @param string $column_name
301	304	* @param int $user_id
		@@ -327,9 +330,9 @@
327	330	*
328	331	* Ensures forum roles are only displayed under the Forum Role list in the
329	332	* WordPress Users list table
330	333	*
331		- * @since 2.6.0 bbPress (r6051)
	334	+ * @since 2.6.0 bbPress (r6052)
332	335	*
333	336	* @return array $roles
334	337	*/
335	338	public static function user_role_list_filter( $roles, $user ) {