Changeset 3607

Timestamp:

11/14/2011 03:50:25 AM (13 years ago)

Author:

johnjamesjacoby

Message:

Introduce bbp_template_redirect() and use for checking various edit screens:

• Introduce bbp_check_forum_edit() to check for forum edit
• Introduce bbp_check_topic_edit() to check for topic edit
• Introduce bbp_check_reply_edit() to check for reply edit
• Introduce bbp_check_topic_tag_edit() to check for topic tag edit
• Introduce bbp_check_user_edit() to check for user edit
• Remove these checks from bbp_pre_get_posts() and only use it to setup query vars
• Fixes #1684, r3605
• For 2.1 (plugin) branch

Location:

branches/plugin/bbp-includes

Files:

• bbp-common-template.php (modified) (1 diff)
• bbp-core-compatibility.php (modified) (2 diffs)
• bbp-core-hooks.php (modified) (3 diffs)
• bbp-forum-functions.php (modified) (1 diff)
• bbp-reply-functions.php (modified) (1 diff)
• bbp-topic-functions.php (modified) (1 diff)
• bbp-user-functions.php (modified) (1 diff)

branches/plugin/bbp-includes/bbp-common-template.php

@@ -484 +484 @@
     $retval = false;
 
-    if ( !empty( $bbp->displayed_user ) && is_user_logged_in() )
+    if ( bbp_is_single_user() && is_user_logged_in() )
         $retval = (bool) ( bbp_get_displayed_user_id() == bbp_get_current_user_id() );
 

branches/plugin/bbp-includes/bbp-core-compatibility.php

@@ -1685 +1685 @@
         if ( !empty( $is_edit ) ) {
 
-            // Only allow super admins on multisite to edit every user.
-            if ( !is_user_logged_in() || ( is_multisite() && !current_user_can( 'manage_network_users' ) && ( $user->ID != bbp_get_current_user_id() ) && !apply_filters( 'enable_edit_any_user_configuration', true ) ) || !current_user_can( 'edit_user', $user->ID ) ) {
-                wp_die( __( 'You do not have permission to edit this user.', 'bbpress' ) );
-            }
-
             // We are editing a profile
             $posts_query->bbp_is_single_user_edit = true;
@@ -1748 +1743 @@
     // Topic/Reply Edit Page
     } elseif ( !empty( $is_edit ) ) {
-
-        // Bail from edit if user is not logged in
-        if ( !is_user_logged_in() )
-            return;
 
         // Get the post type from the main query loop

branches/plugin/bbp-includes/bbp-core-hooks.php

@@ -37 +37 @@
 add_action( 'generate_rewrite_rules', 'bbp_generate_rewrite_rules', 10 );
 add_action( 'wp_enqueue_scripts',     'bbp_enqueue_scripts',        10 );
+add_action( 'template_redirect',      'bbp_template_redirect',      10 );
 add_filter( 'template_include',       'bbp_template_include',       10 );
 
@@ -228 +229 @@
 add_action( 'bbp_activation',   'flush_rewrite_rules' );
 add_action( 'bbp_deactivation', 'flush_rewrite_rules' );
+
+// Redirect user if needed
+add_action( 'bbp_template_redirect', 'bbp_check_user_edit',      10 );
+add_action( 'bbp_template_redirect', 'bbp_check_forum_edit',     10 );
+add_action( 'bbp_template_redirect', 'bbp_check_topic_edit',     10 );
+add_action( 'bbp_template_redirect', 'bbp_check_reply_edit',     10 );
+add_action( 'bbp_template_redirect', 'bbp_check_topic_tag_edit', 10 );
 
 /**
@@ -741 +749 @@
 }
 
+/** Theme Permissions *********************************************************/
+
+/**
+ * The main action used for redirecting bbPress theme actions that are not
+ * permitted by the current_user
+ *
+ * @since bbPress (r3605)
+ *
+ * @uses do_action()
+ */
+function bbp_template_redirect() {
+    do_action( 'bbp_template_redirect' );
+}
+
 ?>

branches/plugin/bbp-includes/bbp-forum-functions.php

@@ -1147 +1147 @@
 }
 
+/** Permissions ***************************************************************/
+
+/**
+ * Redirect if unathorized user is attempting to edit a forum
+ * 
+ * @since bbPress (r3607)
+ *
+ * @uses bbp_is_forum_edit()
+ * @uses current_user_can()
+ * @uses bbp_get_forum_id()
+ * @uses wp_safe_redirect()
+ * @uses bbp_get_forum_permalink()
+ */
+function bbp_check_forum_edit() {
+
+    // Bail if not editing a topic
+    if ( !bbp_is_forum_edit() )
+        return;
+
+    // User cannot edit topic, so redirect back to reply
+    if ( !current_user_can( 'edit_forum', bbp_get_forum_id() ) ) {
+        wp_safe_redirect( bbp_get_forum_permalink() );
+        exit();
+    }
+}
+
 ?>

branches/plugin/bbp-includes/bbp-reply-functions.php

@@ -1459 +1459 @@
 }
 
+/** Permissions ***************************************************************/
+
+/**
+ * Redirect if unathorized user is attempting to edit a reply
+ * 
+ * @since bbPress (r3605)
+ *
+ * @uses bbp_is_reply_edit()
+ * @uses current_user_can()
+ * @uses bbp_get_topic_id()
+ * @uses wp_safe_redirect()
+ * @uses bbp_get_topic_permalink()
+ */
+function bbp_check_reply_edit() {
+
+    // Bail if not editing a topic
+    if ( !bbp_is_reply_edit() )
+        return;
+
+    // User cannot edit topic, so redirect back to reply
+    if ( !current_user_can( 'edit_reply', bbp_get_reply_id() ) ) {
+        wp_safe_redirect( bbp_get_reply_url() );
+        exit();
+    }
+}
+
 ?>

branches/plugin/bbp-includes/bbp-topic-functions.php

@@ -3057 +3057 @@
 }
 
+/** Permissions ***************************************************************/
+
+/**
+ * Redirect if unathorized user is attempting to edit a topic
+ * 
+ * @since bbPress (r3605)
+ *
+ * @uses bbp_is_topic_edit()
+ * @uses current_user_can()
+ * @uses bbp_get_topic_id()
+ * @uses wp_safe_redirect()
+ * @uses bbp_get_topic_permalink()
+ */
+function bbp_check_topic_edit() {
+
+    // Bail if not editing a topic
+    if ( !bbp_is_topic_edit() )
+        return;
+
+    // User cannot edit topic, so redirect back to topic
+    if ( !current_user_can( 'edit_topic', bbp_get_topic_id() ) ) {
+        wp_safe_redirect( bbp_get_topic_permalink() );
+        exit();
+    }
+}
+
+/**
+ * Redirect if unathorized user is attempting to edit a topic tag
+ * 
+ * @since bbPress (r3605)
+ *
+ * @uses bbp_is_topic_tag_edit()
+ * @uses current_user_can()
+ * @uses bbp_get_topic_tag_id()
+ * @uses wp_safe_redirect()
+ * @uses bbp_get_topic_tag_link()
+ */
+function bbp_check_topic_tag_edit() {
+
+    // Bail if not editing a topic tag
+    if ( !bbp_is_topic_tag_edit() )
+        return;
+
+    // Bail if current user cannot edit topic tags
+    if ( !current_user_can( 'edit_topic_tags', bbp_get_topic_tag_id() ) ) {
+        wp_safe_redirect( bbp_get_topic_tag_link() );
+        exit();
+    }
+}
+
 ?>

branches/plugin/bbp-includes/bbp-user-functions.php

@@ -1249 +1249 @@
 }
 
+/** Premissions ***************************************************************/
+
+/**
+ * Redirect if unathorized user is attempting to edit a topic
+ * 
+ * @since bbPress (r3605)
+ *
+ * @uses bbp_is_topic_edit()
+ * @uses current_user_can()
+ * @uses bbp_get_topic_id()
+ * @uses wp_safe_redirect()
+ * @uses bbp_get_topic_permalink()
+ */
+function bbp_check_user_edit() {
+
+    // Bail if not editing a topic
+    if ( !bbp_is_single_user_edit() )
+        return;
+
+    // Only allow super admins on multisite to edit every user.
+    if ( !is_user_logged_in() || ( is_multisite() && !current_user_can( 'manage_network_users' ) && bbp_is_user_home() && !apply_filters( 'enable_edit_any_user_configuration', true ) ) || !current_user_can( 'edit_user', bbp_get_displayed_user_id() ) ) {
+        wp_safe_redirect( bbp_get_user_profile_url( bbp_get_displayed_user_id() ) );
+        exit();
+    }
+}
+
 ?>