Changeset 7489 for trunk/src/includes/admin/forums.php

Timestamp:

09/11/2026 09:03:14 PM (4 weeks ago)

Author:

johnjamesjacoby

Message:

Forums: Restrict forum structure and attributes.

Require global forum authority to change hierarchy, order, moderator assignments, and access attributes across theme, admin, REST, and XML-RPC edits. Introduce an object-level capability so BuddyPress Group Admins can manage attributes for their own Group Forums without granting structural access to Group Moderators.

In trunk, for 2.7.

Props hieunx91.

File:

• trunk/src/includes/admin/forums.php (modified) (3 diffs)

trunk/src/includes/admin/forums.php

@@ -231 +231 @@
          */
         public function attributes_metabox() {
+
+                // Bail if the current user cannot edit forum structure
+                if ( ! current_user_can( 'assign_moderators' ) ) {
+                        return;
+                }
+
                 add_meta_box(
                         'bbp_forum_attributes',
@@ -341 +347 @@
                 }
 
+                // Bail if current user cannot edit forum structure
+                if ( ! current_user_can( 'assign_moderators' ) ) {
+                        return $forum_id;
+                }
+
                 // Parent ID
                 $parent_id = ( ! empty( $_POST['parent_id'] ) && is_numeric( $_POST['parent_id'] ) )
@@ -386 +397 @@
 
                 // What is the user doing here?
-                if ( ! current_user_can( 'edit_forum', $forum_id ) ) {
+                if ( ! current_user_can( 'manage_forum_attributes', $forum_id ) ) {
                         wp_die( esc_html__( 'You do not have permission to do that.', 'bbpress' ) );
                 }