Changeset 7192 for branches/2.6/src/includes/topics/functions.php

Timestamp:

02/18/2021 06:33:29 AM (6 years ago)

Author:

johnjamesjacoby

Message:

Post Statuses: Audit forum/topic/reply, new/edit handlers.

This change normalizes the approaches between post types and actions, to ensure predictable behavior and avoid PHP notices from undefined status variables in certain situations.

It also adds a capability check to the bbp_topic_status condition, so that it is not engaged when the UI was not exposed in the posted form.

Props dd32.

In branches/2.6 for 2.6.7. Fixes #3420.

File:

• branches/2.6/src/includes/topics/functions.php (modified) (2 diffs)

branches/2.6/src/includes/topics/functions.php

@@ -265 +265 @@
         $topic_statuses = bbp_get_topic_statuses();
 
-        // Maybe put into moderation
+        // Default to published
+        $topic_status = bbp_get_public_status_id();
+
+        // Maybe force into pending
         if ( ! bbp_check_for_moderation( $anonymous_data, $topic_author, $topic_title, $topic_content ) ) {
                 $topic_status = bbp_get_pending_status_id();
 
-        // Check possible topic status ID's
+        // Check for possible posted topic status
         } elseif ( ! empty( $_POST['bbp_topic_status'] ) && in_array( $_POST['bbp_topic_status'], array_keys( $topic_statuses ), true ) ) {
-                $topic_status = sanitize_key( $_POST['bbp_topic_status'] );
-
-        // Default to published if nothing else
-        } else {
-                $topic_status = bbp_get_public_status_id();
+
+                // Allow capable users to explicitly override the status
+                if ( current_user_can( 'moderate', $forum_id ) ) {
+                        $topic_status = sanitize_key( $_POST['bbp_topic_status'] );
+
+                // Not capable
+                } else {
+                        bbp_add_error( 'bbp_new_topic_status', __( '<strong>Error</strong>: You do not have permission to do that.', 'bbpress' ) );
+                }
         }
 
@@ -561 +568 @@
         $topic_statuses = bbp_get_topic_statuses( $topic_id );
 
-        // Maybe put into moderation
-        if ( ! bbp_check_for_moderation( $anonymous_data, $topic_author, $topic_title, $topic_content ) ) {
-
-                // Set post status to pending if public or closed
-                if ( bbp_is_topic_public( $topic->ID ) ) {
-                        $topic_status = bbp_get_pending_status_id();
-                }
-
-        // Check possible topic status ID's
+        // Use existing post_status
+        $topic_status = $topic->post_status;
+
+        // Maybe force into pending
+        if ( bbp_is_topic_public( $topic->ID ) && ! bbp_check_for_moderation( $anonymous_data, $topic_author, $topic_title, $topic_content ) ) {
+                $topic_status = bbp_get_pending_status_id();
+
+        // Check for possible posted topic status
         } elseif ( ! empty( $_POST['bbp_topic_status'] ) && in_array( $_POST['bbp_topic_status'], array_keys( $topic_statuses ), true ) ) {
-                $topic_status = sanitize_key( $_POST['bbp_topic_status'] );
-
-        // Use existing post_status
-        } else {
-                $topic_status = $topic->post_status;
+
+                // Allow capable users to explicitly override the status
+                if ( current_user_can( 'moderate', $forum_id ) ) {
+                        $topic_status = sanitize_key( $_POST['bbp_topic_status'] );
+
+                // Not capable
+                } else {
+                        bbp_add_error( 'bbp_edit_topic_status', __( '<strong>Error</strong>: You do not have permission to do that.', 'bbpress' ) );
+                }
         }