← All changes | includes/users/functions.php +95 -39 2.6.17 → 2.6.19 View file →

		@@ -40,9 +40,9 @@
40	40
41	41	/**
42	42	* Is an anonymous topic/reply being made?
43	43	*
44		- * @since 2.0.0 bbPress (r2688)
	44	+ * @since 2.0.0 bbPress (r2670)
45	45	*
46	46	* @return bool True if anonymous is allowed and user is not logged in, false if
47	47	* anonymous is not allowed or user is logged in
48	48	*/
		@@ -120,9 +120,9 @@
120	120
121	121	// Setup cookie expiration
122	122	$lifetime = (int) apply_filters( 'comment_cookie_lifetime', 30000000 );
123	123	$expiry = time() + $lifetime;
124		- $secure = ( 'https' === parse_url( home_url(), PHP_URL_SCHEME ) );
	124	+ $secure = ( 'https' === wp_parse_url( home_url(), PHP_URL_SCHEME ) );
125	125
126	126	// Set the cookies
127	127	setcookie( 'comment_author_' . COOKIEHASH, $anonymous_data['bbp_anonymous_name'], $expiry, COOKIEPATH, COOKIE_DOMAIN, $secure );
128	128	setcookie( 'comment_author_email_' . COOKIEHASH, $anonymous_data['bbp_anonymous_email'], $expiry, COOKIEPATH, COOKIE_DOMAIN, $secure );
		@@ -153,9 +153,9 @@
153	153
154	154	/**
155	155	* Get the poster user agent
156	156	*
157		- * @since 2.0.0 bbPress (r3446)
	157	+ * @since 2.0.0 bbPress (r3447)
158	158	*
159	159	* @return string
160	160	*/
161	161	function bbp_current_author_ua() {
		@@ -171,9 +171,9 @@
171	171
172	172	/**
173	173	* Filter user profile data according to the current user's field permissions.
174	174	*
175		- * @since 2.6.17
	175	+ * @since 2.6.17 bbPress (r7514)
176	176	*
177	177	* @param array $data Submitted user profile data.
178	178	* @param int $user_id User being edited.
179	179	* @return array Filtered user profile data.
		@@ -228,9 +228,9 @@
228	228	*
229	229	* Self-service changes require confirmation by default, while privileged edits
230	230	* to another user update the address directly.
231	231	*
232		- * @since 2.6.17
	232	+ * @since 2.6.17 bbPress (r7514)
233	233	*
234	234	* @param int $user_id User being edited.
235	235	* @return bool Whether confirmation is required.
236	236	*/
		@@ -242,11 +242,38 @@
242	242	return (bool) apply_filters( 'bbp_user_email_change_requires_confirmation', $retval, $user_id, bbp_get_current_user_id() );
243	243	}
244	244
245	245	/**
	246	+ * Update a user's network role when the profile form submitted that field.
	247	+ *
	248	+ * A missing checkbox is ambiguous unless the form also submits its presence
	249	+ * marker. Continue accepting checked boxes from older custom templates.
	250	+ *
	251	+ * @since 2.6.19 bbPress (r7696)
	252	+ *
	253	+ * @param int $user_id User being edited.
	254	+ * @param array $data Submitted profile fields.
	255	+ */
	256	+function bbp_maybe_update_user_super_admin( $user_id = 0, $data = array() ) {
	257	+ if ( ! is_multisite() || bbp_is_user_home_edit() || ! current_user_can( 'manage_network_options' ) || ! is_super_admin() ) {
	258	+ return;
	259	+ }
	260	+
	261	+ if ( ! isset( $data['bbp_super_admin_present'] ) && ! isset( $data['super_admin'] ) ) {
	262	+ return;
	263	+ }
	264	+
	265	+ if ( empty( $data['super_admin'] ) ) {
	266	+ revoke_super_admin( $user_id );
	267	+ } else {
	268	+ grant_super_admin( $user_id );
	269	+ }
	270	+}
	271	+
	272	+/**
246	273	* Handles the front end user editing from POST requests
247	274	*
248		- * @since 2.0.0 bbPress (r2790)
	275	+ * @since 2.0.0 bbPress (r2688)
249	276	*
250	277	* @param string $action The requested action to compare this function to
251	278	*/
252	279	function bbp_edit_user_handler( $action = '' ) {
		@@ -348,13 +375,9 @@
348	375	// Successful edit to redirect
349	376	} elseif ( is_integer( $edit_user ) ) {
350	377
351	378	// Maybe update super admin ability
352		- if ( is_multisite() && ! bbp_is_user_home_edit() && current_user_can( 'manage_network_options' ) && is_super_admin() ) {
353		- empty( $_POST['super_admin'] )
354		- ? revoke_super_admin( $edit_user )
355		- : grant_super_admin( $edit_user );
356		- }
	379	+ bbp_maybe_update_user_super_admin( $edit_user, $_POST );
357	380
358	381	// Redirect
359	382	$args = array( 'updated' => 'true' );
360	383	$user_url = bbp_get_user_profile_edit_url( $edit_user );
		@@ -366,9 +389,9 @@
366	389
367	390	/**
368	391	* Handles user email address updating from GET requests
369	392	*
370		- * @since 2.6.0 bbPress (r5660)
	393	+ * @since 2.6.0 bbPress (r5663)
371	394	*
372	395	* @param string $action
373	396	*/
374	397	function bbp_user_email_change_handler( $action = '' ) {
		@@ -466,9 +489,9 @@
466	489
467	490	/**
468	491	* Sends an email when an email address change occurs on POST requests
469	492	*
470		- * @since 2.6.0 bbPress (r5660)
	493	+ * @since 2.6.0 bbPress (r5663)
471	494	*
472	495	* @see send_confirmation_on_profile_email()
473	496	*/
474	497	function bbp_edit_user_email_send_notification( $user_id = 0, $args = array() ) {
		@@ -552,9 +575,9 @@
552	575	* This allows clever plugin authors to conditionally unhook the WordPress core
553	576	* output actions if they don't want any unexpected junk to appear there, and
554	577	* also avoids needing to pollute the templates with additional logic and actions.
555	578	*
556		- * @since 2.2.0 bbPress (r4273)
	579	+ * @since 2.2.0 bbPress (r4274)
557	580	*/
558	581	function bbp_user_edit_after() {
559	582	$action = bbp_is_user_home_edit() ? 'show_user_profile' : 'edit_user_profile';
560	583
		@@ -566,9 +589,9 @@
566	589	/**
567	590	* Get the topics that a user created
568	591	*
569	592	* @since 2.0.0 bbPress (r2660)
570		- * @since 2.6.0 bbPress (r6618) Signature changed to accept an array of arguments
	593	+ * @since 2.6.0 bbPress (r6619) Signature changed to accept an array of arguments
571	594	*
572	595	* @param array $args Optional. Arguments to pass into bbp_has_topics()
573	596	*
574	597	* @return bool True if user has started topics, otherwise false
		@@ -600,10 +623,10 @@
600	623
601	624	/**
602	625	* Get the replies that a user created
603	626	*
604		- * @since 2.2.0 bbPress (r4225)
605		- * @since 2.6.0 bbPress (r6618) Signature changed to accept an array of arguments
	627	+ * @since 2.2.0 bbPress (r4228)
	628	+ * @since 2.6.0 bbPress (r6619) Signature changed to accept an array of arguments
606	629	*
607	630	* @param array $args Optional. Arguments to pass into bbp_has_replies()
608	631	*
609	632	* @return bool True if user has created replies, otherwise false
		@@ -627,8 +650,10 @@
627	650	);
628	651
629	652	// Parse arguments
630	653	$r = bbp_parse_args( $args, $defaults, 'get_user_replies_created' );
	654	+ $r['_bbp_public_topic_replies'] = ! bbp_get_view_all( 'edit_others_replies' );
	655	+ unset( $r['_bbp_search_private_topic_replies'] );
631	656
632	657	// Get the replies
633	658	$query = bbp_has_replies( $r );
634	659	$user_id = $r['author'];
		@@ -641,9 +666,9 @@
641	666	* Get user IDs from nicenames
642	667	*
643	668	* This function is primarily used when saving object moderators
644	669	*
645		- * @since 2.6.0 bbPress
	670	+ * @since 2.6.0 bbPress (r6056)
646	671	*
647	672	* @param mixed $user_nicenames
648	673	* @return array
649	674	*/
		@@ -684,9 +709,9 @@
684	709	* Get user nicenames from IDs
685	710	*
686	711	* This function is primarily used when saving object moderators
687	712	*
688		- * @since 2.6.0 bbPress
	713	+ * @since 2.6.0 bbPress (r6056)
689	714	*
690	715	* @param mixed $user_ids
691	716	* @return array
692	717	*/
		@@ -772,9 +797,9 @@
772	797	/**
773	798	* Bump the topic count for a user by a certain amount.
774	799	*
775	800	* @since 2.6.0 bbPress (r5309)
776		- * @since 2.6.17 Rebuild the count when the user option is missing.
	801	+ * @since 2.6.17 bbPress (r7451) Rebuild the count when the user option is missing.
777	802	*
778	803	* @param int $user_id
779	804	* @param int $difference
780	805	*/
		@@ -813,9 +838,9 @@
813	838	/**
814	839	* Bump the reply count for a user by a certain amount.
815	840	*
816	841	* @since 2.6.0 bbPress (r5309)
817		- * @since 2.6.17 Rebuild the count when the user option is missing.
	842	+ * @since 2.6.17 bbPress (r7451) Rebuild the count when the user option is missing.
818	843	*
819	844	* @param int $user_id
820	845	* @param int $difference
821	846	*/
		@@ -853,9 +878,9 @@
853	878
854	879	/**
855	880	* Update user counts when a topic or reply changes authors.
856	881	*
857		- * @since 2.6.17
	882	+ * @since 2.6.17 bbPress (r7468)
858	883	*
859	884	* @param int $post_id Post ID.
860	885	* @param WP_Post $post_after Post object following the update.
861	886	* @param WP_Post $post_before Post object before the update.
		@@ -915,9 +940,9 @@
915	940
916	941	/**
917	942	* Update topic engagements when a topic or reply changes authors.
918	943	*
919		- * @since 2.6.17
	944	+ * @since 2.6.17 bbPress (r7468)
920	945	*
921	946	* @param int $post_id Post ID.
922	947	* @param WP_Post $post_after Post object following the update.
923	948	* @param WP_Post $post_before Post object before the update.
		@@ -949,9 +974,9 @@
949	974	* WordPress reassigns post authors directly in the database, bypassing the
950	975	* normal post update actions. Record affected topics before that write, then
951	976	* repair the replacement user's counts and those topics after it completes.
952	977	*
953		- * @since 2.6.17
	978	+ * @since 2.6.17 bbPress (r7468)
954	979	*
955	980	* @param int $user_id ID of the user being deleted.
956	981	* @param int|null $reassign ID of the user receiving the posts.
957	982	*/
		@@ -1094,9 +1119,9 @@
1094	1119	* which a user can edit another user (or themselves.) If these conditions are
1095	1120	* met, we assume a user cannot perform this task, and look for ways they can
1096	1121	* earn the ability to access this template.
1097	1122	*
1098		- * @since 2.1.0 bbPress (r3605)
	1123	+ * @since 2.1.0 bbPress (r3607)
1099	1124	*/
1100	1125	function bbp_check_user_edit() {
1101	1126
1102	1127	// Bail if not editing a user
		@@ -1139,9 +1164,9 @@
1139	1164
1140	1165	/**
1141	1166	* Check if a user is blocked, or cannot spectate the forums.
1142	1167	*
1143		- * @since 2.0.0 bbPress (r2996)
	1168	+ * @since 2.2.0 bbPress (r4316)
1144	1169	*/
1145	1170	function bbp_forum_enforce_blocked() {
1146	1171
1147	1172	// Bail if not logged in or keymaster
		@@ -1171,9 +1196,9 @@
1171	1196	* 2. Early versions of bbPress 2.x templates did not escape this data meaning
1172	1197	* a backwards compatible approach like this one was necessary to protect
1173	1198	* existing installations that may have custom template parts.
1174	1199	*
1175		- * @since 2.6.0 bbPress (r5368)
	1200	+ * @since 2.6.0 bbPress (r5369)
1176	1201	*
1177	1202	* @param string $value
1178	1203	* @param string $field
1179	1204	* @param string $context
		@@ -1206,9 +1231,9 @@
1206	1231	case 'user_login' :
1207	1232	case 'display_name' :
1208	1233	case 'first_name' :
1209	1234	case 'last_name' :
1210		- case 'nick_name' :
	1235	+ case 'nickname' :
1211	1236	$filter = ( 'edit' === $context ) ? 'esc_attr' : 'esc_html';
1212	1237	break;
1213	1238
1214	1239	// wp-includes/default-filters.php escapes this for us via esc_url()
		@@ -1228,25 +1253,32 @@
1228	1253
1229	1254	/**
1230	1255	* Convert passwords from previous platform encryption to WordPress encryption.
1231	1256	*
1232		- * @since 2.1.0 bbPress (r3813)
1233		- * @since 2.6.10 bbPress (r7244) Switched from direct query to get_user_by()
	1257	+ * @since 2.1.0 bbPress (r4072)
	1258	+ * @since 2.6.10 bbPress (r7245) Switched from direct query to get_user_by()
	1259	+ * @since 2.6.18 bbPress (r7546) Improved input handling and email login support.
1234	1260	*/
1235	1261	function bbp_user_maybe_convert_pass() {
1236	1262
1237	1263	// Sanitize login
1238		- $login = ! empty( $_POST['log'] )
	1264	+ $login = isset( $_POST['log'] ) && is_string( $_POST['log'] )
1239	1265	? sanitize_user( wp_unslash( $_POST['log'] ) )
1240	1266	: '';
1241	1267
1242		- // Sanitize password
1243		- $pass = ! empty( $_POST['pwd'] )
1244		- ? trim( $_POST['pwd'] )
	1268	+ // Unslash password without changing its literal value
	1269	+ $wp_pass = isset( $_POST['pwd'] ) && is_string( $_POST['pwd'] )
	1270	+ ? $_POST['pwd']
1245	1271	: '';
	1272	+ $pass = wp_unslash( $wp_pass );
1246	1273
	1274	+ // Match WordPress's default password limit before invoking a legacy converter.
	1275	+ if ( strlen( $wp_pass ) > 4096 ) {
	1276	+ return;
	1277	+ }
	1278	+
1247	1279	// Bail if no username or password
1248		- if ( empty( $login ) || empty( $pass ) ) {
	1280	+ if ( '' === $login || '' === $pass ) {
1249	1281	return;
1250	1282	}
1251	1283
1252	1284	// Get user by login...
		@@ -1262,11 +1294,31 @@
1262	1294	return;
1263	1295	}
1264	1296
1265	1297	// Get converter class from usermeta
1266		- $class = get_user_meta( $user->ID, '_bbp_class', true );
	1298	+ $class = get_user_meta( $user->ID, '_bbp_class', true );
	1299	+ $has_password_meta = metadata_exists( 'user', $user->ID, '_bbp_password' );
	1300	+ $user_pass_class = false;
1267	1301
1268		- // Bail if no converter class in meta
	1302	+ // Older imports may have password metadata without a converter class. Use
	1303	+ // the saved import platform as a candidate; its password callback still
	1304	+ // needs to verify the stored legacy hash before changing the account.
	1305	+ if ( empty( $class ) && $has_password_meta ) {
	1306	+ $class = get_option( '_bbp_converter_platform' );
	1307	+ }
	1308	+
	1309	+ // Completed Drupal 7 and PHPWind imports stored source data directly in
	1310	+ // user_pass and removed temporary password metadata. Their callbacks must
	1311	+ // verify the legacy value before changing the account.
	1312	+ if ( ! $has_password_meta ) {
	1313	+ if ( empty( $class ) && in_array( get_option( '_bbp_converter_platform' ), array( 'Drupal7', 'PHPWind' ), true ) ) {
	1314	+ $class = get_option( '_bbp_converter_platform' );
	1315	+ }
	1316	+
	1317	+ $user_pass_class = in_array( $class, array( 'Drupal7', 'PHPWind' ), true );
	1318	+ }
	1319	+
	1320	+ // Bail if no converter class
1269	1321	if ( empty( $class ) || ! is_string( $class ) ) {
1270	1322	return;
1271	1323	}
1272	1324
		@@ -1280,9 +1332,13 @@
1280	1332	if ( empty( $converter ) ) {
1281	1333	return;
1282	1334	}
1283	1335
	1336	+ // Try to upgrade a password stored directly in the users table
	1337	+ if ( $user_pass_class && ( $converter instanceof BBP_Converter_Base ) && method_exists( $converter, 'callback_user_pass' ) ) {
	1338	+ $converter->callback_user_pass( $user, $pass, $wp_pass );
	1339	+
1284	1340	// Try to call the password conversion callback method
1285		- if ( ( $converter instanceof BBP_Converter_Base ) && method_exists( $converter, 'callback_pass' ) ) {
1286		- $converter->callback_pass( $login, $pass );
	1341	+ } elseif ( ( $converter instanceof BBP_Converter_Base ) && method_exists( $converter, 'callback_pass' ) ) {
	1342	+ $converter->callback_pass( $user->user_login, $pass, $wp_pass );
1287	1343	}
1288	1344	}