← All changes | includes/users/capabilities.php +27 -21 2.6.17 → 2.6.19 View file →

		@@ -11,9 +11,10 @@
11	11
12	12	/**
13	13	* Maps primary capabilities
14	14	*
15		- * @since 2.2.0 bbPress (r4242)
	15	+ * @since 2.2.0 bbPress (r4244)
	16	+ * @since 2.6.19 bbPress (r7690) Limit super moderator edits to site members and protect peer roles.
16	17	*
17	18	* @param array $caps Capabilities for meta capability.
18	19	* @param string $cap Capability name.
19	20	* @param int $user_id User id.
		@@ -114,11 +115,12 @@
114	115	/** Super Moderators **************************************************/
115	116
116	117	case 'edit_user' :
117	118	case 'promote_user' :
	119	+ $wp_query = bbp_get_wp_query();
118	120
119	121	// Moderators can edit users if super moderators is enabled.
120		- if ( bbp_allow_super_mods() && ! is_admin() && bbp_is_single_user_edit() ) {
	122	+ if ( bbp_allow_super_mods() && ! is_admin() && ! empty( $wp_query->bbp_is_single_user ) && ( true === $wp_query->bbp_is_single_user ) ) {
121	123
122	124	// Get the user ID
123	125	$_user_id = ! empty( $args[0] )
124	126	? (int) $args[0]
		@@ -126,13 +128,15 @@
126	128
127	129	// Users can always edit themselves, so only map for others.
128	130	if ( ! empty( $_user_id ) && ( $_user_id !== $user_id ) ) {
129	131
130		- // Super moderators cannot edit keymasters or site administrators.
	132	+ // Limit edits to site members and protect staff roles from peers.
131	133	if (
132		- ! bbp_is_user_keymaster( $_user_id )
	134	+ ( ! is_multisite() || is_user_member_of_blog( $_user_id ) )
	135	+ && ! bbp_is_user_keymaster( $_user_id )
133	136	&& ! user_can( $_user_id, 'manage_options' )
134	137	&& ! is_super_admin( $_user_id )
	138	+ && ( ( 'edit_user' === $cap ) || ! user_can( $_user_id, 'moderate' ) )
135	139	) {
136	140	$caps = array( 'moderate' );
137	141	}
138	142	}
		@@ -147,9 +151,9 @@
147	151
148	152	/**
149	153	* Set a user's role in the forums
150	154	*
151		- * @since 2.1.0 bbPress (r3860)
	155	+ * @since 2.2.0 bbPress (r4289)
152	156	*
153	157	* @param int $user_id
154	158	*
155	159	* @return mixed False if no change. String of new role if changed.
		@@ -232,9 +236,9 @@
232	236
233	237	/**
234	238	* Return a user's blog role
235	239	*
236		- * @since 2.3.0 bbPress (r4446)
	240	+ * @since 2.3.0 bbPress (r4447)
237	241	*
238	242	* @param int $user_id
239	243	*
240	244	* @return string
		@@ -272,9 +276,9 @@
272	276	*
273	277	* By default, this is hooked to the `bbp_profile_update` action which fires
274	278	* after a user profile is updated to avoid being stomped by set_role().
275	279	*
276		- * @since 2.2.0 bbPress (r4235)
	280	+ * @since 2.2.0 bbPress (r4330)
277	281	*
278	282	* @param int $user_id
279	283	*
280	284	* @return void If no user ID passed, invalid request, trying to set own role,
		@@ -327,9 +331,10 @@
327	331
328	332	/**
329	333	* Return the forum roles the current user may assign to another user.
330	334	*
331		- * @since 2.6.17
	335	+ * @since 2.6.17 bbPress (r7514)
	336	+ * @since 2.6.19 bbPress (r7686) Allow site administrators to assign staff roles.
332	337	*
333	338	* @param int $user_id User being edited. Defaults to the displayed user.
334	339	* @return array Filtered array of editable forum roles.
335	340	*/
		@@ -336,10 +341,10 @@
336	341	function bbp_get_user_editable_forum_roles( $user_id = 0 ) {
337	342	$user_id = bbp_get_user_id( $user_id, false, false );
338	343	$roles = bbp_get_dynamic_roles();
339	344
340		- // Moderators may assign non-staff roles by default.
341		- if ( ! bbp_is_user_keymaster() ) {
	345	+ // Only keymasters and site administrators may assign staff roles.
	346	+ if ( ! bbp_is_user_keymaster() && ! current_user_can( 'manage_options' ) ) {
342	347	unset(
343	348	$roles[ bbp_get_keymaster_role() ],
344	349	$roles[ bbp_get_moderator_role() ]
345	350	);
		@@ -351,9 +356,9 @@
351	356
352	357	/**
353	358	* Return whether the current user may edit a user-profile field.
354	359	*
355		- * @since 2.6.17
	360	+ * @since 2.6.17 bbPress (r7514)
356	361	*
357	362	* @param string $field Profile field group: profile, email, password,
358	363	* site_role, or forum_role.
359	364	* @param int $user_id User being edited. Defaults to the displayed user.
		@@ -367,8 +372,9 @@
367	372	$retval = current_user_can( 'edit_user', $user_id );
368	373
369	374	// Apply narrower defaults to sensitive field groups.
370	375	switch ( $field ) {
	376	+ case 'email':
371	377	case 'password':
372	378	$retval = ! empty( $user_id )
373	379	&& ! empty( $current_user_id )
374	380	&& $retval
		@@ -393,9 +399,9 @@
393	399
394	400	/**
395	401	* Check if a role string is valid
396	402	*
397		- * @since 2.6.5
	403	+ * @since 2.6.5 bbPress (r7087)
398	404	*
399	405	* @param string $role
400	406	*
401	407	* @return bool True if role is valid. False if role is not valid.
		@@ -428,9 +434,9 @@
428	434	*
429	435	* This function will bail if the forum is not global in a multisite
430	436	* installation of WordPress, or if the user is marked as spam or deleted.
431	437	*
432		- * @since 2.0.0 bbPress (r3380)
	438	+ * @since 2.2.0 bbPress (r4185)
433	439	*
434	440	* @return void If not multisite, not global, or user is deleted/spammed
435	441	*/
436	442	function bbp_set_current_user_default_role() {
		@@ -503,9 +509,9 @@
503	509	* Return a map of WordPress roles to bbPress roles. Used to automatically grant
504	510	* appropriate bbPress roles to WordPress users that wouldn't already have a
505	511	* role in the forums. Also guarantees WordPress admins get the Keymaster role.
506	512	*
507		- * @since 2.2.0 bbPress (r4334)
	513	+ * @since 2.2.0 bbPress (r4335)
508	514	*
509	515	* @return array Filtered array of WordPress roles to bbPress roles
510	516	*/
511	517	function bbp_get_user_role_map() {
		@@ -530,9 +536,9 @@
530	536
531	537	/**
532	538	* Checks if the user has been marked as a spammer.
533	539	*
534		- * @since 2.0.0 bbPress (r3355)
	540	+ * @since 2.0.0 bbPress (r3356)
535	541	*
536	542	* @param int $user_id int The ID for the user.
537	543	* @return bool True if spammer, False if not.
538	544	*/
		@@ -569,9 +575,9 @@
569	575
570	576	/**
571	577	* Mark a users topics and replies as spam when the user is marked as spam
572	578	*
573		- * @since 2.0.0 bbPress (r3405)
	579	+ * @since 2.0.0 bbPress (r3410)
574	580	*
575	581	* @param int $user_id Optional. User ID to spam. Defaults to displayed user.
576	582	*
577	583	* @return bool If no user ID passed.
		@@ -656,9 +662,9 @@
656	662
657	663	/**
658	664	* Mark a users topics and replies as spam when the user is marked as spam
659	665	*
660		- * @since 2.0.0 bbPress (r3405)
	666	+ * @since 2.0.0 bbPress (r3410)
661	667	*
662	668	* @param int $user_id Optional. User ID to unspam. Defaults to displayed user.
663	669	*
664	670	* @return bool If no user ID passed.
		@@ -747,9 +753,9 @@
747	753
748	754	/**
749	755	* Checks if the user has been marked as deleted.
750	756	*
751		- * @since 2.0.0 bbPress (r3355)
	757	+ * @since 2.0.0 bbPress (r3356)
752	758	*
753	759	* @param int $user_id int The ID for the user.
754	760	* @return bool True if deleted, False if not.
755	761	*/
		@@ -786,9 +792,9 @@
786	792
787	793	/**
788	794	* Checks if user is active
789	795	*
790		- * @since 2.0.0 bbPress (r3502)
	796	+ * @since 2.0.0 bbPress (r3504)
791	797	*
792	798	* @param int $user_id The user ID to check
793	799	* @return bool True if public, false if not
794	800	*/
		@@ -816,9 +822,9 @@
816	822
817	823	/**
818	824	* Checks if user is not active.
819	825	*
820		- * @since 2.0.0 bbPress (r3502)
	826	+ * @since 2.0.0 bbPress (r3504)
821	827	*
822	828	* @param int $user_id The user ID to check. Defaults to current user ID
823	829	* @return bool True if inactive, false if active
824	830	*/
		@@ -844,9 +850,9 @@
844	850
845	851	/**
846	852	* Does a user have a profile for the current site
847	853	*
848		- * @since 2.2.0 bbPress (r4362)
	854	+ * @since 2.2.0 bbPress (r4363)
849	855	*
850	856	* @param int $user_id User ID to check
851	857	*
852	858	* @return bool Whether or not the user has a profile on this blog_id.