← All changes | includes/users/capabilities.php +25 -20 2.6.18 → 2.6.19 View file →

		@@ -11,9 +11,10 @@
11	11
12	12	/**
13	13	* Maps primary capabilities
14	14	*
15		- * @since 2.2.0 bbPress (r4242)
	15	+ * @since 2.2.0 bbPress (r4244)
	16	+ * @since 2.6.19 bbPress (r7690) Limit super moderator edits to site members and protect peer roles.
16	17	*
17	18	* @param array $caps Capabilities for meta capability.
18	19	* @param string $cap Capability name.
19	20	* @param int $user_id User id.
		@@ -127,13 +128,15 @@
127	128
128	129	// Users can always edit themselves, so only map for others.
129	130	if ( ! empty( $_user_id ) && ( $_user_id !== $user_id ) ) {
130	131
131		- // Super moderators cannot edit keymasters or site administrators.
	132	+ // Limit edits to site members and protect staff roles from peers.
132	133	if (
133		- ! bbp_is_user_keymaster( $_user_id )
	134	+ ( ! is_multisite() || is_user_member_of_blog( $_user_id ) )
	135	+ && ! bbp_is_user_keymaster( $_user_id )
134	136	&& ! user_can( $_user_id, 'manage_options' )
135	137	&& ! is_super_admin( $_user_id )
	138	+ && ( ( 'edit_user' === $cap ) || ! user_can( $_user_id, 'moderate' ) )
136	139	) {
137	140	$caps = array( 'moderate' );
138	141	}
139	142	}
		@@ -148,9 +151,9 @@
148	151
149	152	/**
150	153	* Set a user's role in the forums
151	154	*
152		- * @since 2.1.0 bbPress (r3860)
	155	+ * @since 2.2.0 bbPress (r4289)
153	156	*
154	157	* @param int $user_id
155	158	*
156	159	* @return mixed False if no change. String of new role if changed.
		@@ -233,9 +236,9 @@
233	236
234	237	/**
235	238	* Return a user's blog role
236	239	*
237		- * @since 2.3.0 bbPress (r4446)
	240	+ * @since 2.3.0 bbPress (r4447)
238	241	*
239	242	* @param int $user_id
240	243	*
241	244	* @return string
		@@ -273,9 +276,9 @@
273	276	*
274	277	* By default, this is hooked to the `bbp_profile_update` action which fires
275	278	* after a user profile is updated to avoid being stomped by set_role().
276	279	*
277		- * @since 2.2.0 bbPress (r4235)
	280	+ * @since 2.2.0 bbPress (r4330)
278	281	*
279	282	* @param int $user_id
280	283	*
281	284	* @return void If no user ID passed, invalid request, trying to set own role,
		@@ -328,9 +331,10 @@
328	331
329	332	/**
330	333	* Return the forum roles the current user may assign to another user.
331	334	*
332		- * @since 2.6.17
	335	+ * @since 2.6.17 bbPress (r7514)
	336	+ * @since 2.6.19 bbPress (r7686) Allow site administrators to assign staff roles.
333	337	*
334	338	* @param int $user_id User being edited. Defaults to the displayed user.
335	339	* @return array Filtered array of editable forum roles.
336	340	*/
		@@ -337,10 +341,10 @@
337	341	function bbp_get_user_editable_forum_roles( $user_id = 0 ) {
338	342	$user_id = bbp_get_user_id( $user_id, false, false );
339	343	$roles = bbp_get_dynamic_roles();
340	344
341		- // Moderators may assign non-staff roles by default.
342		- if ( ! bbp_is_user_keymaster() ) {
	345	+ // Only keymasters and site administrators may assign staff roles.
	346	+ if ( ! bbp_is_user_keymaster() && ! current_user_can( 'manage_options' ) ) {
343	347	unset(
344	348	$roles[ bbp_get_keymaster_role() ],
345	349	$roles[ bbp_get_moderator_role() ]
346	350	);
		@@ -352,9 +356,9 @@
352	356
353	357	/**
354	358	* Return whether the current user may edit a user-profile field.
355	359	*
356		- * @since 2.6.17
	360	+ * @since 2.6.17 bbPress (r7514)
357	361	*
358	362	* @param string $field Profile field group: profile, email, password,
359	363	* site_role, or forum_role.
360	364	* @param int $user_id User being edited. Defaults to the displayed user.
		@@ -368,8 +372,9 @@
368	372	$retval = current_user_can( 'edit_user', $user_id );
369	373
370	374	// Apply narrower defaults to sensitive field groups.
371	375	switch ( $field ) {
	376	+ case 'email':
372	377	case 'password':
373	378	$retval = ! empty( $user_id )
374	379	&& ! empty( $current_user_id )
375	380	&& $retval
		@@ -394,9 +399,9 @@
394	399
395	400	/**
396	401	* Check if a role string is valid
397	402	*
398		- * @since 2.6.5
	403	+ * @since 2.6.5 bbPress (r7087)
399	404	*
400	405	* @param string $role
401	406	*
402	407	* @return bool True if role is valid. False if role is not valid.
		@@ -429,9 +434,9 @@
429	434	*
430	435	* This function will bail if the forum is not global in a multisite
431	436	* installation of WordPress, or if the user is marked as spam or deleted.
432	437	*
433		- * @since 2.0.0 bbPress (r3380)
	438	+ * @since 2.2.0 bbPress (r4185)
434	439	*
435	440	* @return void If not multisite, not global, or user is deleted/spammed
436	441	*/
437	442	function bbp_set_current_user_default_role() {
		@@ -504,9 +509,9 @@
504	509	* Return a map of WordPress roles to bbPress roles. Used to automatically grant
505	510	* appropriate bbPress roles to WordPress users that wouldn't already have a
506	511	* role in the forums. Also guarantees WordPress admins get the Keymaster role.
507	512	*
508		- * @since 2.2.0 bbPress (r4334)
	513	+ * @since 2.2.0 bbPress (r4335)
509	514	*
510	515	* @return array Filtered array of WordPress roles to bbPress roles
511	516	*/
512	517	function bbp_get_user_role_map() {
		@@ -531,9 +536,9 @@
531	536
532	537	/**
533	538	* Checks if the user has been marked as a spammer.
534	539	*
535		- * @since 2.0.0 bbPress (r3355)
	540	+ * @since 2.0.0 bbPress (r3356)
536	541	*
537	542	* @param int $user_id int The ID for the user.
538	543	* @return bool True if spammer, False if not.
539	544	*/
		@@ -570,9 +575,9 @@
570	575
571	576	/**
572	577	* Mark a users topics and replies as spam when the user is marked as spam
573	578	*
574		- * @since 2.0.0 bbPress (r3405)
	579	+ * @since 2.0.0 bbPress (r3410)
575	580	*
576	581	* @param int $user_id Optional. User ID to spam. Defaults to displayed user.
577	582	*
578	583	* @return bool If no user ID passed.
		@@ -657,9 +662,9 @@
657	662
658	663	/**
659	664	* Mark a users topics and replies as spam when the user is marked as spam
660	665	*
661		- * @since 2.0.0 bbPress (r3405)
	666	+ * @since 2.0.0 bbPress (r3410)
662	667	*
663	668	* @param int $user_id Optional. User ID to unspam. Defaults to displayed user.
664	669	*
665	670	* @return bool If no user ID passed.
		@@ -748,9 +753,9 @@
748	753
749	754	/**
750	755	* Checks if the user has been marked as deleted.
751	756	*
752		- * @since 2.0.0 bbPress (r3355)
	757	+ * @since 2.0.0 bbPress (r3356)
753	758	*
754	759	* @param int $user_id int The ID for the user.
755	760	* @return bool True if deleted, False if not.
756	761	*/
		@@ -787,9 +792,9 @@
787	792
788	793	/**
789	794	* Checks if user is active
790	795	*
791		- * @since 2.0.0 bbPress (r3502)
	796	+ * @since 2.0.0 bbPress (r3504)
792	797	*
793	798	* @param int $user_id The user ID to check
794	799	* @return bool True if public, false if not
795	800	*/
		@@ -817,9 +822,9 @@
817	822
818	823	/**
819	824	* Checks if user is not active.
820	825	*
821		- * @since 2.0.0 bbPress (r3502)
	826	+ * @since 2.0.0 bbPress (r3504)
822	827	*
823	828	* @param int $user_id The user ID to check. Defaults to current user ID
824	829	* @return bool True if inactive, false if active
825	830	*/
		@@ -845,9 +850,9 @@
845	850
846	851	/**
847	852	* Does a user have a profile for the current site
848	853	*
849		- * @since 2.2.0 bbPress (r4362)
	854	+ * @since 2.2.0 bbPress (r4363)
850	855	*
851	856	* @param int $user_id User ID to check
852	857	*
853	858	* @return bool Whether or not the user has a profile on this blog_id.