Changeset 8058

Timestamp:

10/17/2026 05:35:45 AM (6 days ago)

Author:

johnjamesjacoby

Message:

Common: Inherit forum password requirements.

Extend WordPress's post-password check to bbPress forums, topics, and replies so Core-rendered content respects password-protected ancestors. Reuse the existing ancestor lookup with a per-post re-entry guard to preserve exact protected-post IDs, password cookies, and third-party filter behavior.

Add regression coverage for archive and search loops, user roles, password cookies, and nested password checks.

In branches/2.6, for 2.6.21.

See #2453.

Location:

branches/2.6

Files:

• src/includes/common/template.php (modified) (2 diffs)
• src/includes/core/filters.php (modified) (1 diff)
• tests/phpunit/testcases/replies/password-visibility.php (modified) (2 diffs)

branches/2.6/src/includes/common/template.php

@@ -517 +517 @@
  */
 function bbp_get_password_required_id( $object_id = 0 ) {
+        static $checking_id = 0;
+
         $post     = get_post( $object_id );
         $post_ids = array();
         $forum_id = 0;
+
+        // Avoid recursion while checking this post's own password.
+        if ( ! empty( $post ) && ( $checking_id === (int) $post->ID ) ) {
+                return 0;
+        }
 
         // Include the object
@@ -548 +555 @@
 
         // Check the object and its parents
-        foreach ( array_unique( array_filter( $post_ids ) ) as $post_id ) {
-                if ( post_password_required( $post_id ) ) {
-                        return (int) $post_id;
+        foreach ( array_unique( array_map( 'intval', array_filter( $post_ids ) ) ) as $post_id ) {
+                $previous_id = $checking_id;
+                $checking_id = $post_id;
+
+                try {
+                        $required = post_password_required( $post_id );
+                } finally {
+                        $checking_id = $previous_id;
                 }
+
+                if ( $required ) {
+                        return $post_id;
+                }
         }
 
         return 0;
+}
+
+/**
+ * Require passwords inherited from bbPress parent topics and forums.
+ *
+ * WordPress checks only the current post. Extend that check for bbPress posts
+ * so Core content and excerpt rendering preserves the same password boundary
+ * as bbPress templates.
+ *
+ * @since 2.6.21 bbPress (r8058)
+ *
+ * @param bool         $required Whether the current post requires a password.
+ * @param WP_Post|null $post     Post object.
+ * @return bool Whether the post or a bbPress ancestor requires a password.
+ */
+function bbp_filter_post_password_required( $required, $post = null ) {
+        if ( $required || ! ( $post instanceof WP_Post ) || ! bbp_is_custom_post_type( $post ) ) {
+                return $required;
+        }
+
+        return ( 0 !== bbp_get_password_required_id( $post ) );
 }
 

branches/2.6/src/includes/core/filters.php

@@ -78 +78 @@
 // Reply title fallback
 add_filter( 'the_title', 'bbp_get_reply_title_fallback', 2, 2 );
+
+// Inherited post passwords
+add_filter( 'post_password_required', 'bbp_filter_post_password_required', 10, 2 );
 
 // Avoid queries & 404s

branches/2.6/tests/phpunit/testcases/replies/password-visibility.php

@@ -8 +8 @@
  */
 class BBP_Tests_Replies_Password_Visibility extends BBP_UnitTestCase {
+
+        /**
+         * @covers ::bbp_filter_post_password_required
+         */
+        public function test_password_required_guard_allows_unrelated_nested_checks() {
+                $forum_id = $this->factory->forum->create(
+                        array( 'post_password' => 'first-secret' )
+                );
+                list( $topic_id, $reply_id ) = $this->create_reply_in_forum( $forum_id );
+
+                $other_forum_id = $this->factory->forum->create(
+                        array( 'post_password' => 'second-secret' )
+                );
+                list( , $other_reply_id ) = $this->create_reply_in_forum( $other_forum_id );
+                $nested_password_id = 0;
+                $filter             = function( $required, $post ) use ( $topic_id, $other_reply_id, &$nested_password_id ) {
+                        if ( $topic_id === $post->ID ) {
+                                $nested_password_id = bbp_get_password_required_id( $other_reply_id );
+                        }
+
+                        return $required;
+                };
+
+                add_filter( 'post_password_required', $filter, 20, 2 );
+
+                try {
+                        $this->assertSame( $forum_id, bbp_get_password_required_id( $reply_id ) );
+                        $this->assertSame( $other_forum_id, $nested_password_id );
+                } finally {
+                        remove_filter( 'post_password_required', $filter, 20 );
+                }
+        }
+
+        /**
+         * @covers ::bbp_filter_post_password_required
+         */
+        public function test_password_required_filter_ignores_missing_post() {
+                $this->assertFalse( bbp_filter_post_password_required( false, null ) );
+        }
+
+        /**
+         * @covers ::bbp_filter_post_password_required
+         */
+        public function test_core_reply_listings_require_parent_forum_password_for_all_roles() {
+                $forum_id = $this->factory->forum->create(
+                        array( 'post_password' => 'forum-secret' )
+                );
+                list( , $reply_id ) = $this->create_reply_in_forum(
+                        $forum_id,
+                        'Protected core reply marker'
+                );
+                $user_ids = array(
+                        0,
+                        $this->create_user_without_role(),
+                        $this->create_user_with_bbp_role( bbp_get_participant_role() ),
+                        $this->create_user_with_bbp_role( bbp_get_moderator_role() ),
+                        $this->create_user_with_bbp_role( bbp_get_keymaster_role() ),
+                );
+                $cookie     = 'wp-postpass_' . COOKIEHASH;
+                $old_cookie = isset( $_COOKIE[ $cookie ] ) ? $_COOKIE[ $cookie ] : null;
+
+                try {
+                        foreach ( $user_ids as $user_id ) {
+                                $this->set_current_user( $user_id );
+
+                                foreach ( array( '/?post_type=reply', '/?s=Protected&post_type=reply' ) as $url ) {
+                                        $this->go_to_without_reregistering_blocks( $url );
+                                        $this->assertContains( $reply_id, wp_list_pluck( $GLOBALS['wp_query']->posts, 'ID' ) );
+                                        $this->assertTrue( post_password_required( $reply_id ) );
+                                        $this->assertStringNotContainsString( 'Protected core reply marker', get_the_content( null, false, $reply_id ) );
+                                }
+                        }
+
+                        require_once ABSPATH . WPINC . '/class-phpass.php';
+                        $hasher            = new PasswordHash( 8, true );
+                        $_COOKIE[ $cookie ] = $hasher->HashPassword( 'forum-secret' );
+
+                        $this->set_current_user( 0 );
+                        $this->assertFalse( post_password_required( $reply_id ) );
+                        $this->assertStringContainsString( 'Protected core reply marker', get_the_content( null, false, $reply_id ) );
+                } finally {
+                        $this->set_current_user( 0 );
+
+                        if ( null === $old_cookie ) {
+                                unset( $_COOKIE[ $cookie ] );
+                        } else {
+                                $_COOKIE[ $cookie ] = $old_cookie;
+                        }
+                }
+        }
 
         /**
@@ -47 +137 @@
                 }
         }
+
+        private function create_user_without_role() {
+                $user_id = $this->factory->user->create();
+                $user    = new WP_User( $user_id );
+                $user->set_role( '' );
+
+                return $user_id;
+        }
+
+        private function create_reply_in_forum( $forum_id, $content = '' ) {
+                $topic_id = $this->factory->topic->create(
+                        array(
+                                'post_parent' => $forum_id,
+                                'topic_meta'  => array( 'forum_id' => $forum_id ),
+                        )
+                );
+                $reply_id = $this->factory->reply->create(
+                        array(
+                                'post_parent'  => $topic_id,
+                                'post_content' => $content,
+                                'reply_meta'   => array( 'forum_id' => $forum_id, 'topic_id' => $topic_id ),
+                        )
+                );
+
+                return array( $topic_id, $reply_id );
+        }
+
+        private function create_user_with_bbp_role( $role ) {
+                $user_id = $this->factory->user->create();
+                bbp_set_user_role( $user_id, $role );
+
+                return $user_id;
+        }
+
+        private function go_to_without_reregistering_blocks( $url ) {
+                remove_action( 'bbp_register', 'bbp_register_blocks', 10 );
+                try {
+                        $this->go_to( home_url( $url ) );
+                } finally {
+                        add_action( 'bbp_register', 'bbp_register_blocks', 10 );
+                }
+        }
 }