Changeset 5188

Timestamp:

11/25/2013 03:35:27 AM (11 years ago)

Author:

johnjamesjacoby

Message:

In bbp_user_can_view_forum() check the $user_id before passing it into bbp_is_user_keymaster(). Prevents accidental role escalation if $user_id is empty. See #2393.

File:

• trunk/includes/users/template.php (modified) (1 diff)

trunk/includes/users/template.php

@@ -1724 +1724 @@
 
     // User is a keymaster
-    if ( bbp_is_user_keymaster( $user_id ) ) {
+    if ( !empty( $user_id ) && bbp_is_user_keymaster( $user_id ) ) {
         $retval = true;