Changeset 4180

Timestamp:

08/29/2012 02:52:38 PM (14 years ago)

Author:

johnjamesjacoby

Message:

Capabilities:

• Remove bbp_masked capability when setting the user role.
• Do not set a fake role in bbp_global_access_role_mask().
• Rename variable in bbp_global_access_role_mask() to be more literal.
• Add note to phpdoc of bbp_global_access_role_mask().

File:

• branches/plugin/bbp-includes/bbp-core-caps.php (modified) (4 diffs)

branches/plugin/bbp-includes/bbp-core-caps.php

@@ -726 +726 @@
                 return;
 
+        // Bail if not logged in or already a member of this site
+        if ( ! is_user_logged_in() || is_user_member_of_blog() )
+                return;
+
         // Bail if user is not active
         if ( bbp_is_user_inactive() )
                 return;
 
-        // Bail if user is not logged in
-        if ( !is_user_logged_in() )
+        // Give the user the default role
+        if ( ! current_user_can( 'bbp_masked' ) )
                 return;
 
-        // Give the user the default role
-        if ( current_user_can( 'bbp_masked' ) ) {
-                bbpress()->current_user->set_role( get_option( 'default_role' ) );
-        }
+        // Make sure the bbp_masked cap doesn't get saved to the DB
+        bbpress()->current_user->remove_cap( 'bbp_masked' );
+
+        // Set user to default role for blog
+        bbpress()->current_user->set_role( get_option( 'default_role', 'subscriber' ) );
 }
 
@@ -745 +750 @@
  * This function will bail if the forum is not global in a multisite
  * installation of WordPress, or if the user is marked as spam or deleted.
+ *
+ * Note that we do not currently add a capability for the default role of the
+ * site. This is to prevent unauthorized role-based access, since we have no
+ * idea what plugins might be doing to that role. This may change in the future,
+ * so it's best not to rely heavily on this for now.
  *
  * @since bbPress (r3380)
@@ -771 +781 @@
                 return;
 
-        // Assign user the default role to map caps to
-        $default_role  = get_option( 'default_role', 'subscriber' );
-
-        // Get bbPress caps for the default role
-        $caps_for_role = bbp_get_caps_for_role( $default_role );
-
         // Set all caps to true
-        foreach ( $caps_for_role as $cap )
+        foreach ( bbp_get_caps_for_role() as $cap )
                 $default_caps[$cap] = true;
 
         // Add 'read' cap just in case
-        $default_caps['read']       = true;
         $default_caps['bbp_masked'] = true;
 
@@ -790 +793 @@
         // Assign the role and mapped caps to the current user
         $bbp = bbpress();
-        $bbp->current_user->roles[0] = $default_role;
         $bbp->current_user->caps     = $default_caps;
         $bbp->current_user->allcaps  = $default_caps;