Changeset 4906

Timestamp:

05/14/2013 10:53:36 PM (13 years ago)

Author:

johnjamesjacoby

Message:

When adding/editing a reply, check the current forum status and visibility, and make sure the current user is able to post to it. Fixes an issue where replies could be posted to closed forums if the nonce check still passed. (trunk)

File:

• trunk/includes/replies/functions.php (modified) (2 diffs)

trunk/includes/replies/functions.php

@@ -164 +164 @@
     } else {
         bbp_add_error( 'bbp_reply_forum_id', __( '<strong>ERROR</strong>: Forum ID is missing.', 'bbpress' ) );
+    }
+
+    // Forum exists
+    if ( !empty( $forum_id ) ) {
+
+        // Forum is a category
+        if ( bbp_is_forum_category( $forum_id ) ) {
+            bbp_add_error( 'bbp_new_reply_forum_category', __( '<strong>ERROR</strong>: This forum is a category. No replies can be created in this forum.', 'bbpress' ) );
+
+        // Forum is not a category
+        } else {
+
+            // Forum is closed and user cannot access
+            if ( bbp_is_forum_closed( $forum_id ) && !current_user_can( 'edit_forum', $forum_id ) ) {
+                bbp_add_error( 'bbp_new_reply_forum_closed', __( '<strong>ERROR</strong>: This forum has been closed to new replies.', 'bbpress' ) );
+            }
+
+            // Forum is private and user cannot access
+            if ( bbp_is_forum_private( $forum_id ) ) {
+                if ( !current_user_can( 'read_private_forums' ) ) {
+                    bbp_add_error( 'bbp_new_reply_forum_private', __( '<strong>ERROR</strong>: This forum is private and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
+                }
+
+            // Forum is hidden and user cannot access
+            } elseif ( bbp_is_forum_hidden( $forum_id ) ) {
+                if ( !current_user_can( 'read_hidden_forums' ) ) {
+                    bbp_add_error( 'bbp_new_reply_forum_hidden', __( '<strong>ERROR</strong>: This forum is hidden and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
+                }
+            }
+        }
     }
 
@@ -476 +506 @@
 
         // Forum is a category
-        if ( bbp_is_forum_category( $forum_id ) )
-            bbp_add_error( 'bbp_edit_reply_forum_category', __( '<strong>ERROR</strong>: This forum is a category. No topics or replies can be created in it.', 'bbpress' ) );
-
-        // Forum is closed and user cannot access
-        if ( bbp_is_forum_closed( $forum_id ) && !current_user_can( 'edit_forum', $forum_id ) )
-            bbp_add_error( 'bbp_edit_reply_forum_closed', __( '<strong>ERROR</strong>: This forum has been closed to new topics and replies.', 'bbpress' ) );
-
-        // Forum is private and user cannot access
-        if ( bbp_is_forum_private( $forum_id ) && !current_user_can( 'read_private_forums' ) )
-            bbp_add_error( 'bbp_edit_reply_forum_private', __( '<strong>ERROR</strong>: This forum is private and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
-
-        // Forum is hidden and user cannot access
-        if ( bbp_is_forum_hidden( $forum_id ) && !current_user_can( 'read_hidden_forums' ) )
-            bbp_add_error( 'bbp_edit_reply_forum_hidden', __( '<strong>ERROR</strong>: This forum is hidden and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
+        if ( bbp_is_forum_category( $forum_id ) ) {
+            bbp_add_error( 'bbp_edit_reply_forum_category', __( '<strong>ERROR</strong>: This forum is a category. No replies can be created in this forum.', 'bbpress' ) );
+
+        // Forum is not a category
+        } else {
+
+            // Forum is closed and user cannot access
+            if ( bbp_is_forum_closed( $forum_id ) && !current_user_can( 'edit_forum', $forum_id ) ) {
+                bbp_add_error( 'bbp_edit_reply_forum_closed', __( '<strong>ERROR</strong>: This forum has been closed to new replies.', 'bbpress' ) );
+            }
+
+            // Forum is private and user cannot access
+            if ( bbp_is_forum_private( $forum_id ) ) {
+                if ( !current_user_can( 'read_private_forums' ) ) {
+                    bbp_add_error( 'bbp_edit_reply_forum_private', __( '<strong>ERROR</strong>: This forum is private and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
+                }
+
+            // Forum is hidden and user cannot access
+            } elseif ( bbp_is_forum_hidden( $forum_id ) ) {
+                if ( !current_user_can( 'read_hidden_forums' ) ) {
+                    bbp_add_error( 'bbp_edit_reply_forum_hidden', __( '<strong>ERROR</strong>: This forum is hidden and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
+                }
+            }
+        }
     }