Changeset 6032

Timestamp:

05/25/2016 01:23:29 AM (9 years ago)

Author:

johnjamesjacoby

Message:

Moderators: pass current forum/topic/reply ID into moderate capability checks, providing additional context about what's being moderated so more targeted decisions can be made.

See #459.

Location:

trunk/src

Files:

• includes/admin/metaboxes.php (modified) (1 diff)
• includes/admin/replies.php (modified) (2 diffs)
• includes/admin/topics.php (modified) (1 diff)
• includes/forums/functions.php (modified) (1 diff)
• includes/replies/functions.php (modified) (1 diff)
• includes/topics/functions.php (modified) (3 diffs)
• includes/users/template.php (modified) (1 diff)
• templates/default/bbpress/form-reply.php (modified) (1 diff)
• templates/default/bbpress/form-topic.php (modified) (1 diff)

trunk/src/includes/admin/metaboxes.php

@@ -495 +495 @@
 
     // Only allow individual manipulation of reply forum if there is a mismatch
-    if ( ( $reply_forum_id !== $topic_forum_id ) && ( current_user_can( 'edit_others_replies' ) || current_user_can( 'moderate' ) ) ) : ?>
+    if ( ( $reply_forum_id !== $topic_forum_id ) && ( current_user_can( 'edit_others_replies' ) || current_user_can( 'moderate', $post_id ) ) ) : ?>
 
         <p>

trunk/src/includes/admin/replies.php

@@ -716 +716 @@
                     // Alert capable users of reply forum mismatch
                     if ( $reply_forum_id !== $topic_forum_id ) {
-                        if ( current_user_can( 'edit_others_replies' ) || current_user_can( 'moderate' ) ) {
+                        if ( current_user_can( 'edit_others_replies' ) || current_user_can( 'moderate', $reply_id ) ) {
                             $forum_title .= '<div class="attention">' . esc_html__( '(Mismatch)', 'bbpress' ) . '</div>';
                         }
@@ -851 +851 @@
         }
 
-        // Add Empty Spam button
+        // Add "Empty Spam" button for moderators
         if ( ! empty( $_GET['post_status'] ) && ( bbp_get_spam_status_id() === $_GET['post_status'] ) && current_user_can( 'moderate' ) ) {
             wp_nonce_field( 'bulk-destroy', '_destroy_nonce' );
-            $title = esc_attr__( 'Empty Spam', 'bbpress' );
-            submit_button( $title, 'button-secondary apply', 'delete_all', false );
+            submit_button( 
+                esc_attr__( 'Empty Spam', 'bbpress' ),
+                'button-secondary apply',
+                'delete_all',
+                false
+            );
         }
 
         // Get which forum is selected
-        $selected = ! empty( $_GET['bbp_forum_id'] ) ? $_GET['bbp_forum_id'] : '';
+        $selected = ! empty( $_GET['bbp_forum_id'] )
+            ? (int) $_GET['bbp_forum_id']
+            : 0;
 
         // Show the forums dropdown

trunk/src/includes/admin/topics.php

@@ -1004 +1004 @@
         }
 
-        // Add Empty Spam button
+        // Add "Empty Spam" button for moderators
         if ( ! empty( $_GET['post_status'] ) && ( bbp_get_spam_status_id() === $_GET['post_status'] ) && current_user_can( 'moderate' ) ) {
             wp_nonce_field( 'bulk-destroy', '_destroy_nonce' );
-            $title = esc_attr__( 'Empty Spam', 'bbpress' );
-            submit_button( $title, 'button-secondary apply', 'delete_all', false );
+            submit_button( 
+                esc_attr__( 'Empty Spam', 'bbpress' ),
+                'button-secondary apply',
+                'delete_all',
+                false
+            );
         }
 
         // Get which forum is selected
-        $selected = ! empty( $_GET['bbp_forum_id'] ) ? $_GET['bbp_forum_id'] : '';
+        $selected = ! empty( $_GET['bbp_forum_id'] )
+            ? (int) $_GET['bbp_forum_id']
+            : 0;
 
         // Show the forums dropdown

trunk/src/includes/forums/functions.php

@@ -339 +339 @@
 
             // User can moderate, so redirect to forum with view all set
-            if ( current_user_can( 'moderate' ) ) {
+            if ( current_user_can( 'moderate', $forum_id ) ) {
                 $redirect_url = bbp_add_view_all( $redirect_url );
 

trunk/src/includes/replies/functions.php

@@ -319 +319 @@
 
     // If topic is closed, moderators can still reply
-    if ( bbp_is_topic_closed( $topic_id ) && ! current_user_can( 'moderate' ) ) {
+    if ( bbp_is_topic_closed( $topic_id ) && ! current_user_can( 'moderate', $topic_id ) ) {
         bbp_add_error( 'bbp_reply_topic_closed', __( '<strong>ERROR</strong>: Topic is closed.', 'bbpress' ) );
     }

trunk/src/includes/topics/functions.php

@@ -389 +389 @@
 
             // What's the caps?
-            if ( current_user_can( 'moderate' ) ) {
+            if ( current_user_can( 'moderate', $topic_id ) ) {
 
                 // What's the haps?
@@ -428 +428 @@
 
             // User can moderate, so redirect to topic with view all set
-            if ( current_user_can( 'moderate' ) ) {
+            if ( current_user_can( 'moderate', $topic_id ) ) {
                 $redirect_url = bbp_add_view_all( $redirect_url );
 
@@ -760 +760 @@
 
             // What's the caps?
-            if ( current_user_can( 'moderate' ) ) {
+            if ( current_user_can( 'moderate', $topic_id ) ) {
 
                 // What's the haps?

trunk/src/includes/users/template.php

@@ -553 +553 @@
      */
     function bbp_get_admin_link( $args = array() ) {
+
+        // Bail if user cannot globally moderate
         if ( ! current_user_can( 'moderate' ) ) {
             return;

trunk/src/templates/default/bbpress/form-reply.php

@@ -109 +109 @@
                     <?php if ( bbp_is_reply_edit() ) : ?>
 
-                        <?php if ( current_user_can( 'moderate' ) ) : ?>
+                        <?php if ( current_user_can( 'moderate', bbp_get_reply_id() ) ) : ?>
 
                             <?php do_action( 'bbp_theme_before_reply_form_reply_to' ); ?>

trunk/src/templates/default/bbpress/form-topic.php

@@ -130 +130 @@
                     <?php endif; ?>
 
-                    <?php if ( current_user_can( 'moderate' ) ) : ?>
+                    <?php if ( current_user_can( 'moderate', bbp_get_topic_id() ) ) : ?>
 
                         <?php do_action( 'bbp_theme_before_topic_form_type' ); ?>