Changeset 7086 for trunk/src/includes/users/capabilities.php

Timestamp:

05/28/2020 03:38:54 PM (6 years ago)

Author:

johnjamesjacoby

Message:

Signups: Ensure that the dynamic role exists before setting it.

This commit introduces several new helper functions for validating Forum roles before saving & assigning them to new user accounts.

It also adds relevant capability checks to prevent unauthorized users from performing role assignments.

In trunk, for 2.7.0.

See #3157.

File:

• trunk/src/includes/users/capabilities.php (modified) (4 diffs)

trunk/src/includes/users/capabilities.php

@@ -149 +149 @@
  * @param int $user_id
  *
- * @return string
+ * @return mixed False if no change. String of new role if changed.
  */
 function bbp_set_user_role( $user_id = 0, $new_role = '' ) {
@@ -160 +160 @@
     if ( ! empty( $user ) ) {
 
-        // Get users forum role
+        // Get user forum role
         $role = bbp_get_user_role( $user_id );
 
@@ -167 +167 @@
             $new_role = false;
 
-        // Users role is different than the new role
-        } else {
+        // User role is different than the new (valid) role
+        } elseif ( bbp_is_valid_role( $new_role ) ) {
 
             // Remove the old role
@@ -305 +305 @@
     // Set the new forums role
     bbp_set_user_role( $user_id, $new_role );
+}
+
+/**
+ * Check if a role ID is valid
+ *
+ * This helper function accepts a role ID as a string, and compares it against
+ * the array of registered dynamic roles.
+ *
+ * Use this function anytime you are manually attempting to set a user role
+ * without using the bbp_set_user_role() function, or if you need to halt
+ * additional processing during role validation.
+ *
+ * @since 2.6.5
+ *
+ * @param string $role A well-formed (string) role ID to validate
+ *
+ * @return bool True if role is valid. False if role is not valid.
+ */
+function bbp_is_valid_role( $role = '' ) {
+
+    // Default return value
+    $retval = false;
+
+    // Skip if no role to check
+    if ( ! empty( $role ) && is_string( $role ) ) {
+
+        // Get the dynamic role IDs
+        $roles = array_keys( bbp_get_dynamic_roles() );
+
+        // Skip if no known role IDs
+        if ( ! empty( $roles ) ) {
+
+            // Is role in dynamic roles array?
+            $retval = in_array( $role, $roles, true );
+        }
+    }
+
+    // Filter & return
+    return (bool) apply_filters( 'bbp_is_valid_role', $retval, $role );
 }