Changeset 7484

Timestamp:

09/11/2026 04:22:26 AM (9 days ago)

Author:

johnjamesjacoby

Message:

Replies: Authorize the topic's forum.

Backport the reply forum authorization fix from trunk. Always derive the forum used for reply creation and capability checks from the submitted topic, and call read_forum for every forum so inherited restrictions are enforced.

Add regression coverage for normal replies and participant attempts to target hidden and inherited restricted forums.

Merges r7483 to 2.6.

In branches/2.6, for 2.6.16.

Props vvh1te3zz.

Location:

branches/2.6

Files:

• src/includes/replies/functions.php (modified) (3 diffs)
• tests/phpunit/testcases/replies/functions/permissions.php (modified) (5 diffs)

branches/2.6/src/includes/replies/functions.php

@@ -209 +209 @@
         /** Forum ID **************************************************************/
 
-        // Try to use the forum id of the topic
-        if ( ! isset( $_POST['bbp_forum_id'] ) && ! empty( $topic_id ) ) {
+        // Use the forum id of the topic
+        if ( ! empty( $topic_id ) ) {
                 $forum_id = bbp_get_topic_forum_id( $topic_id );
+        }
 
         // Error check the POST'ed forum id
-        } elseif ( isset( $_POST['bbp_forum_id'] ) ) {
+        if ( isset( $_POST['bbp_forum_id'] ) ) {
 
                 // Empty Forum id was passed
@@ -242 +243 @@
                                 bbp_add_error( 'bbp_topic_forum_id', __( '<strong>Error</strong>: Forum does not exist.', 'bbpress' ) );
 
-                        // Use the POST'ed forum id
-                        } else {
-                                $forum_id = $posted_forum_id;
                         }
                 }
@@ -264 +262 @@
                         }
 
-                        // Forum is private and user cannot access
-                        if ( bbp_is_forum_private( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) {
-                                bbp_add_error( 'bbp_new_reply_forum_private', __( '<strong>Error</strong>: This forum is private and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
-
-                        // Forum is hidden and user cannot access
-                        } elseif ( bbp_is_forum_hidden( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) {
-                                bbp_add_error( 'bbp_new_reply_forum_hidden', __( '<strong>Error</strong>: This forum is hidden and you do not have the capability to read or create new replies in it.', 'bbpress' ) );
+                        // Forum not readable by user
+                        if ( ! current_user_can( 'read_forum', $forum_id ) ) {
+                                bbp_add_error( 'bbp_new_reply_forum_read', __( '<strong>Error</strong>: You do not have the capability to read or create new replies in this forum.', 'bbpress' ) );
                         }
                 }

branches/2.6/tests/phpunit/testcases/replies/functions/permissions.php

@@ -33 +33 @@
         }
 
-        /**
-         * @covers ::bbp_new_reply_handler
-         */
-        public function test_participant_cannot_submit_reply_to_private_topic() {
-                $forum_id = $this->factory->forum->create();
-                $topic_id = $this->factory->topic->create(
-                        array(
-                                'post_status' => bbp_get_private_status_id(),
-                                'post_parent' => $forum_id,
-                                'topic_meta'  => array(
-                                        'forum_id' => $forum_id,
-                                ),
-                        )
-                );
-                $user_id  = $this->factory->user->create(
-                        array(
-                                'role' => bbp_get_participant_role(),
-                        )
-                );
-
-                $this->set_current_user( $user_id );
-                bbpress()->errors = new WP_Error();
-
-                $this->assertFalse( current_user_can( 'read_topic', $topic_id ) );
-
+        protected function submit_reply( $topic_id, $forum_id = null, $content = '', $anonymous_data = array() ) {
                 $home_url             = wp_parse_url( home_url( '/' ) );
                 $_SERVER['HTTP_HOST'] = $home_url['host'];
@@ -66 +42 @@
 
                 $_SERVER['REQUEST_URI']     = $home_url['path'];
+                $_SERVER['REMOTE_ADDR']     = '127.0.0.1';
                 $_POST['bbp_topic_id']      = $topic_id;
-                $_POST['bbp_reply_content'] = 'A reply to a private topic.';
+                $_POST['bbp_reply_content'] = $content;
                 $_REQUEST['_wpnonce']       = wp_create_nonce( 'bbp-new-reply' );
+
+                if ( null !== $forum_id ) {
+                        $_POST['bbp_forum_id'] = $forum_id;
+                }
+
+                $_POST = array_merge( $_POST, $anonymous_data );
 
                 $did_redirect     = false;
                 $prevent_redirect = function( $location ) use ( &$did_redirect ) {
                         $did_redirect = true;
-                        throw new RuntimeException( 'Unexpected reply redirect.' );
+                        throw new RuntimeException( 'Reply redirect.' );
                 };
+                $prevent_cookies  = function() {
+                        return array();
+                };
 
                 add_filter( 'wp_redirect', $prevent_redirect );
+                add_filter( 'bbp_filter_anonymous_post_data', $prevent_cookies );
 
                 try {
                         bbp_new_reply_handler( 'bbp-new-reply' );
                 } catch ( RuntimeException $exception ) {
-                        if ( 'Unexpected reply redirect.' !== $exception->getMessage() ) {
+                        if ( 'Reply redirect.' !== $exception->getMessage() ) {
                                 throw $exception;
                         }
@@ -87 +74 @@
 
                 remove_filter( 'wp_redirect', $prevent_redirect );
-
-                $reply_ids = get_posts(
+                remove_filter( 'bbp_filter_anonymous_post_data', $prevent_cookies );
+
+                return $did_redirect;
+        }
+
+        protected function get_reply_ids( $topic_id ) {
+                return get_posts(
                         array(
                                 'fields'      => 'ids',
@@ -96 +88 @@
                         )
                 );
+        }
+
+        /**
+         * @covers ::bbp_new_reply_handler
+         */
+        public function test_participant_cannot_submit_reply_to_private_topic() {
+                $forum_id = $this->factory->forum->create();
+                $topic_id = $this->factory->topic->create(
+                        array(
+                                'post_status' => bbp_get_private_status_id(),
+                                'post_parent' => $forum_id,
+                                'topic_meta'  => array(
+                                        'forum_id' => $forum_id,
+                                ),
+                        )
+                );
+                $user_id  = $this->factory->user->create(
+                        array(
+                                'role' => bbp_get_participant_role(),
+                        )
+                );
+
+                $this->set_current_user( $user_id );
+                bbpress()->errors = new WP_Error();
+
+                $this->assertFalse( current_user_can( 'read_topic', $topic_id ) );
+
+                $did_redirect = $this->submit_reply( $topic_id, null, 'A reply to a private topic.' );
+                $reply_ids    = $this->get_reply_ids( $topic_id );
 
                 $this->assertSame( array(), $reply_ids );
@@ -101 +122 @@
                 $this->assertFalse( $did_redirect );
         }
+
+        /**
+         * @covers ::bbp_new_reply_handler
+         */
+        public function test_participant_can_submit_reply_when_forum_id_matches_topic() {
+                $forum_id = $this->factory->forum->create();
+                $topic_id = $this->factory->topic->create(
+                        array(
+                                'post_parent' => $forum_id,
+                                'topic_meta'  => array(
+                                        'forum_id' => $forum_id,
+                                ),
+                        )
+                );
+                $user_id  = $this->factory->user->create(
+                        array(
+                                'role' => bbp_get_participant_role(),
+                        )
+                );
+
+                $this->set_current_user( $user_id );
+                bbpress()->errors = new WP_Error();
+
+                $did_redirect = $this->submit_reply( $topic_id, $forum_id, 'A reply to a public topic.' );
+                $reply_ids    = $this->get_reply_ids( $topic_id );
+
+                $this->assertCount( 1, $reply_ids );
+                $this->assertSame( $forum_id, bbp_get_reply_forum_id( $reply_ids[0] ) );
+                $this->assertSame( array(), bbpress()->errors->get_error_codes() );
+                $this->assertTrue( $did_redirect );
+        }
+
+        /**
+         * @covers ::bbp_new_reply_handler
+         */
+        public function test_participant_cannot_spoof_forum_id_to_reply_to_hidden_topic() {
+                $public_forum_id = $this->factory->forum->create();
+                $hidden_forum_id = $this->factory->forum->create(
+                        array(
+                                'post_status' => bbp_get_hidden_status_id(),
+                        )
+                );
+                $topic_id       = $this->factory->topic->create(
+                        array(
+                                'post_parent' => $hidden_forum_id,
+                                'topic_meta'  => array(
+                                        'forum_id' => $hidden_forum_id,
+                                ),
+                        )
+                );
+                $user_id        = $this->factory->user->create(
+                        array(
+                                'role' => bbp_get_participant_role(),
+                        )
+                );
+
+                $this->set_current_user( $user_id );
+                bbpress()->errors = new WP_Error();
+
+                $this->assertTrue( current_user_can( 'read_topic', $topic_id ) );
+                $this->assertFalse( current_user_can( 'read_forum', $hidden_forum_id ) );
+                $this->assertTrue( current_user_can( 'read_forum', $public_forum_id ) );
+
+                $did_redirect = $this->submit_reply( $topic_id, $public_forum_id, 'A reply to a topic in a hidden forum.' );
+                $reply_ids    = $this->get_reply_ids( $topic_id );
+
+                $this->assertSame( array(), $reply_ids );
+                $this->assertContains( 'bbp_new_reply_forum_read', bbpress()->errors->get_error_codes() );
+                $this->assertFalse( $did_redirect );
+        }
+
+        /**
+         * @covers ::bbp_new_reply_handler
+         */
+        public function test_participant_cannot_spoof_forum_id_to_reply_below_hidden_forum() {
+                $public_forum_id = $this->factory->forum->create();
+                $hidden_forum_id = $this->factory->forum->create(
+                        array(
+                                'post_status' => bbp_get_hidden_status_id(),
+                        )
+                );
+                $child_forum_id  = $this->factory->forum->create(
+                        array(
+                                'post_parent' => $hidden_forum_id,
+                        )
+                );
+                $topic_id        = $this->factory->topic->create(
+                        array(
+                                'post_parent' => $child_forum_id,
+                                'topic_meta'  => array(
+                                        'forum_id' => $child_forum_id,
+                                ),
+                        )
+                );
+                $user_id         = $this->factory->user->create(
+                        array(
+                                'role' => bbp_get_participant_role(),
+                        )
+                );
+
+                $this->set_current_user( $user_id );
+                bbpress()->errors = new WP_Error();
+
+                $this->assertTrue( current_user_can( 'read_topic', $topic_id ) );
+                $this->assertFalse( current_user_can( 'read_forum', $child_forum_id ) );
+                $this->assertTrue( current_user_can( 'read_forum', $public_forum_id ) );
+
+                $did_redirect = $this->submit_reply( $topic_id, $public_forum_id, 'A reply below a hidden forum.' );
+                $reply_ids    = $this->get_reply_ids( $topic_id );
+
+                $this->assertSame( array(), $reply_ids );
+                $this->assertContains( 'bbp_new_reply_forum_read', bbpress()->errors->get_error_codes() );
+                $this->assertFalse( $did_redirect );
+        }
+
 }