Skip to:
Content

bbPress.org

Changeset 7089


Ignore:
Timestamp:
05/28/2020 04:31:32 PM (6 weeks ago)
Author:
johnjamesjacoby
Message:

Settings: Only allow users with the edit_users capability to toggle the Super Moderators option.

This commit also rearranges some settings for improved UX, and adds descriptive text to the "Super Moderators" and "Forum Moderators" settings for improved clarity.

This commit addresses a responsibly disclosed security concern, and does not have a public issue in Trac.

In branches/2.6, for 2.6.5.

Location:
branches/2.6/src/includes/admin
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/2.6/src/includes/admin/classes/class-bbp-admin.php

    r7071 r7089  
    586586            // Loop through fields for this section
    587587            foreach ( (array) $fields as $field_id => $field ) {
     588
     589                // Skip field if user is not capable
     590                if ( ! empty( $field['capability'] ) && ! current_user_can( $field['capability'] ) ) {
     591                    continue;
     592                }
    588593
    589594                // Add the field
  • branches/2.6/src/includes/admin/settings.php

    r6966 r7089  
    164164        'bbp_settings_features' => array(
    165165
     166            // Allow auto embedding setting
     167            '_bbp_use_autoembed' => array(
     168                'title'             => esc_html__( 'Auto-embed links', 'bbpress' ),
     169                'callback'          => 'bbp_admin_setting_callback_use_autoembed',
     170                'sanitize_callback' => 'intval',
     171                'args'              => array()
     172            ),
     173
     174            // Set reply threading level
     175            '_bbp_thread_replies_depth' => array(
     176                'title'             => esc_html__( 'Reply Threading', 'bbpress' ),
     177                'callback'          => 'bbp_admin_setting_callback_thread_replies_depth',
     178                'sanitize_callback' => 'intval',
     179                'args'              => array()
     180            ),
     181
     182            // Allow threaded replies
     183            '_bbp_allow_threaded_replies' => array(
     184                'sanitize_callback' => 'intval',
     185                'args'              => array()
     186            ),
     187
    166188            // Allow topic and reply revisions
    167189            '_bbp_allow_revisions' => array(
     
    200222                'title'             => esc_html__( 'Topic tags', 'bbpress' ),
    201223                'callback'          => 'bbp_admin_setting_callback_topic_tags',
    202                 'sanitize_callback' => 'intval',
    203                 'args'              => array()
    204             ),
    205 
    206             // Allow per-forum moderators
    207             '_bbp_allow_forum_mods' => array(
    208                 'title'             => esc_html__( 'Forum Moderators', 'bbpress' ),
    209                 'callback'          => 'bbp_admin_setting_callback_forum_mods',
    210                 'sanitize_callback' => 'intval',
    211                 'args'              => array()
    212             ),
    213 
    214             // Allow moderators to edit users
    215             '_bbp_allow_super_mods' => array(
    216                 'title'             => esc_html__( 'Super Moderators', 'bbpress' ),
    217                 'callback'          => 'bbp_admin_setting_callback_super_mods',
    218224                'sanitize_callback' => 'intval',
    219225                'args'              => array()
     
    236242            ),
    237243
    238             // Allow auto embedding setting
    239             '_bbp_use_autoembed' => array(
    240                 'title'             => esc_html__( 'Auto-embed links', 'bbpress' ),
    241                 'callback'          => 'bbp_admin_setting_callback_use_autoembed',
     244            // Allow per-forum moderators
     245            '_bbp_allow_forum_mods' => array(
     246                'title'             => esc_html__( 'Forum Moderators', 'bbpress' ),
     247                'callback'          => 'bbp_admin_setting_callback_forum_mods',
    242248                'sanitize_callback' => 'intval',
    243249                'args'              => array()
    244250            ),
    245251
    246             // Set reply threading level
    247             '_bbp_thread_replies_depth' => array(
    248                 'title'             => esc_html__( 'Reply Threading', 'bbpress' ),
    249                 'callback'          => 'bbp_admin_setting_callback_thread_replies_depth',
    250                 'sanitize_callback' => 'intval',
    251                 'args'              => array()
    252             ),
    253 
    254             // Allow threaded replies
    255             '_bbp_allow_threaded_replies' => array(
    256                 'sanitize_callback' => 'intval',
     252            // Allow moderators to edit users
     253            '_bbp_allow_super_mods' => array(
     254                'title'             => esc_html__( 'Super Moderators', 'bbpress' ),
     255                'callback'          => 'bbp_admin_setting_callback_super_mods',
     256                'sanitize_callback' => 'intval',
     257                'capability'        => 'edit_users',
    257258                'args'              => array()
    258259            )
     
    838839    <input name="_bbp_allow_forum_mods" id="_bbp_allow_forum_mods" type="checkbox" value="1" <?php checked( bbp_allow_forum_mods( true ) ); bbp_maybe_admin_setting_disabled( '_bbp_allow_forum_mods' ); ?> />
    839840    <label for="_bbp_allow_forum_mods"><?php esc_html_e( 'Allow forums to have dedicated moderators', 'bbpress' ); ?></label>
     841    <p class="description"><?php esc_html_e( 'This does not include the ability to edit users.', 'bbpress' ); ?></p>
    840842
    841843<?php
     
    851853
    852854    <input name="_bbp_allow_super_mods" id="_bbp_allow_super_mods" type="checkbox" value="1" <?php checked( bbp_allow_super_mods( false ) ); bbp_maybe_admin_setting_disabled( '_bbp_allow_super_mods' ); ?> />
    853     <label for="_bbp_allow_super_mods"><?php esc_html_e( 'Allow moderators to edit other users', 'bbpress' ); ?></label>
     855    <label for="_bbp_allow_super_mods"><?php esc_html_e( 'Allow Moderators and Keymasters to edit users', 'bbpress' ); ?></label>
     856    <p class="description"><?php esc_html_e( 'This includes roles, passwords, and email addresses.', 'bbpress' ); ?></p>
    854857
    855858<?php
     
    969972    if ( ! empty( $theme_options ) ) : ?>
    970973
    971         <select name="_bbp_theme_package_id" id="_bbp_theme_package_id" <?php bbp_maybe_admin_setting_disabled( '_bbp_theme_package_id' ); ?>><?php echo $theme_options ?></select>
     974        <select name="_bbp_theme_package_id" id="_bbp_theme_package_id" <?php bbp_maybe_admin_setting_disabled( '_bbp_theme_package_id' ); ?>><?php echo $theme_options; ?></select>
    972975        <label for="_bbp_theme_package_id"><?php esc_html_e( 'will serve all bbPress templates', 'bbpress' ); ?></label>
    973976
     
    14651468        // Button & text
    14661469        $button = '<a href="' . esc_url( $new_url ) . '">' . esc_html__( 'create a new one', 'bbpress' ) . '</a>';
    1467         $text   = esc_html__( 'Use %s to contain your group forums, or %s', 'bbpress' );
     1470        $text   = esc_html__( 'Use %s to contain your group forums, or %s', 'bbpress' ); //phpcs:ignore
    14681471    } else {
    14691472        $text = esc_html__( 'Use %s to contain your group forums', 'bbpress' );
     
    15181521
    15191522    <div class="wrap">
    1520         <h1 class="wp-heading-inline"><?php esc_html_e( 'Forums Settings', 'bbpress' ) ?></h1>
     1523        <h1 class="wp-heading-inline"><?php esc_html_e( 'Forums Settings', 'bbpress' ); ?></h1>
    15211524        <hr class="wp-header-end">
    15221525
     
    15681571    } ?>
    15691572
    1570     <select name="_bbp_converter_platform" id="_bbp_converter_platform"><?php echo $options ?></select>
     1573    <select name="_bbp_converter_platform" id="_bbp_converter_platform"><?php echo $options; ?></select>
    15711574    <p class="description"><?php esc_html_e( 'The previous forum software', 'bbpress' ); ?></p>
    15721575
     
    17931796    // Starting or continuing?
    17941797    $progress_text = ! empty( $step )
    1795         ? sprintf( esc_html__( 'Previously stopped at step %d of %d', 'bbpress' ), $step, $max )
     1798        ? sprintf( esc_html__( 'Previously stopped at step %1$d of %2$d', 'bbpress' ), $step, $max )
    17961799        : esc_html__( 'Ready to go.', 'bbpress' ); ?>
    17971800
     
    19581961 * @param bool $slug
    19591962 */
    1960 function bbp_form_option( $option, $default = '' , $slug = false ) {
     1963function bbp_form_option( $option, $default = '', $slug = false ) {
    19611964    echo bbp_get_form_option( $option, $default, $slug );
    19621965}
Note: See TracChangeset for help on using the changeset viewer.