Changeset 6384 for trunk/src/includes/replies/capabilities.php

Timestamp:

03/20/2017 10:44:00 AM (8 years ago)

Author:

johnjamesjacoby

Message:

Moderation: Allow per-forum moderators to edit topics & replies inside of forums they have moderation control over.

This feature require the following changes:

• Prefer read_forum capability check over read_private_forums or read_hidden_forums, and include a $forum_id parameter to assist map_meta_cap filters
• Prefer edit_others_topics|replies over moderate where appropriate, to ensure capability mappings work as intended
• Introduce bbp_get_public_topic_statuses() to replace several duplicate occurrences of the same array usage (also allow these to be filtered)
• Introduce bbp_is_topic_public() (not to be confused with bbp_is_topic_published()) to provide parity with bbp_is_forum_public() and also utilize bbp_get_public_topic_statuses() from above
• Add local caching to bbp_exclude_forum_ids() as a performance optimization to reduce the depth of current_user_can() calls when private & hidden forums are in use
• Add user_can( 'moderate' ) capability checks to various mappings, to ensure forum moderators can read/edit/delete content inside of the individual forums they are moderators of
• Use bbp_get_user_id() where appropriate, rather than casting as int
• Various surrounding code clean-ups

See #2593.

File:

• trunk/src/includes/replies/capabilities.php (modified) (4 diffs)

trunk/src/includes/replies/capabilities.php

@@ -78 +78 @@
                         $caps = array( 'spectate' );
 
+                    // Moderators can always edit forum content
+                    } elseif ( user_can( $user_id, 'moderate', $_post->ID ) ) {
+                        $caps = array( 'spectate' );
+
                     // Unknown so map to private posts
                     } else {
@@ -108 +112 @@
                 $caps = array( 'moderate' );
 
-            // Otherwise, block
+            // Otherwise, check forum
             } else {
-                $caps = array( 'do_not_allow' );
+                $forum_id = bbp_get_forum_id();
+
+                // Moderators can always edit forum content
+                if ( user_can( $user_id, 'moderate', $forum_id ) ) {
+                    $caps = array( 'spectate' );
+
+                // Fallback to do_not_allow
+                } else {
+                    $caps = array( 'do_not_allow' );
+                }
             }
 
@@ -124 +137 @@
                 // Get post type object
                 $post_type = get_post_type_object( $_post->post_type );
-                $caps      = array();
 
                 // Add 'do_not_allow' cap if user is spam or deleted
                 if ( bbp_is_user_inactive( $user_id ) ) {
-                    $caps[] = 'do_not_allow';
+                    $caps = array( 'do_not_allow' );
 
                 // User is author so allow edit if not in admin
                 } elseif ( ! is_admin() && ( (int) $user_id === (int) $_post->post_author ) ) {
-                    $caps[] = $post_type->cap->edit_posts;
-
-                // User is a per-forum moderator, make sure they can spectate.
-                } elseif ( bbp_is_user_forum_moderator( $user_id, bbp_get_reply_forum_id( $_post->ID ) ) ) {
+                    $caps = array( $post_type->cap->edit_posts );
+
+                // Moderators can always edit forum content
+                } elseif ( user_can( $user_id, 'moderate', $_post->ID ) ) {
                     $caps = array( 'spectate' );
 
                 // Fallback to edit_others_posts.
                 } else {
-                    $caps[] = $post_type->cap->edit_others_posts;
+                    $caps = array( $post_type->cap->edit_others_posts );
                 }
             }
@@ -156 +168 @@
                 // Get post type object
                 $post_type = get_post_type_object( $_post->post_type );
-                $caps      = array();
 
                 // Add 'do_not_allow' cap if user is spam or deleted
                 if ( bbp_is_user_inactive( $user_id ) ) {
-                    $caps[] = 'do_not_allow';
-
-                // Moderators can always edit forum content
-                } elseif ( user_can( $user_id, 'moderate' ) ) {
-                    $caps[] = 'moderate';
+                    $caps = array( 'do_not_allow' );
 
                 // User is author so allow delete if not in admin
                 } elseif ( ! is_admin() && ( (int) $user_id === (int) $_post->post_author ) ) {
-                    $caps[] = $post_type->cap->delete_posts;
+                    $caps = array( $post_type->cap->delete_posts );
+
+                // Moderators can always edit forum content
+                } elseif ( user_can( $user_id, 'moderate', $_post->ID ) ) {
+                     $caps = array( 'spectate' );
 
                 // Unknown so map to delete_others_posts
                 } else {
-                    $caps[] = $post_type->cap->delete_others_posts;
+                    $caps = array( $post_type->cap->delete_others_posts );
                 }
             }