Changeset 7088 for trunk/src/includes/admin/classes/class-bbp-admin.php

Timestamp:

05/28/2020 04:24:34 PM (5 years ago)

Author:

johnjamesjacoby

Message:

Settings: Only allow users with the edit_users capability to toggle the Super Moderators option.

This commit also rearranges some settings for improved UX, and adds descriptive text to the "Super Moderators" and "Forum Moderators" settings for improved clarity.

This commit addresses a responsibly disclosed security concern, and does not have a public issue in Trac.

In trunk, for 2.7.0.

File:

• trunk/src/includes/admin/classes/class-bbp-admin.php (modified) (1 diff)

trunk/src/includes/admin/classes/class-bbp-admin.php

@@ -586 +586 @@
             // Loop through fields for this section
             foreach ( (array) $fields as $field_id => $field ) {
+
+                // Skip field if user is not capable
+                if ( ! empty( $field['capability'] ) && ! current_user_can( $field['capability'] ) ) {
+                    continue;
+                }
 
                 // Add the field