Index: src/includes/forums/capabilities.php --- src/includes/forums/capabilities.php +++ src/includes/forums/capabilities.php @@ -61,7 +61,7 @@ case 'read_forum' : // User cannot spectate - if ( ! user_can( $user_id, 'spectate' ) ) { + if ( ! user_can( $user_id, 'spectate' ) && ! bbp_is_anonymous() ) { $caps = array( 'do_not_allow' ); // Do some post ID based logic @@ -81,8 +81,16 @@ // Post is public if ( bbp_get_public_status_id() === $_post->post_status ) { - $caps = array( 'spectate' ); + // Anonymous users do not have caps, but can 'exist' + if ( bbp_is_anonymous() ) { + $caps = array( 'exist' ); + + // Registered users need the 'spectate' cap + } else { + $caps = array( 'spectate' ); + } + // User is author so allow read } elseif ( (int) $user_id === (int) $_post->post_author ) { $caps = array( 'spectate' ); Index: src/includes/forums/functions.php --- src/includes/forums/functions.php +++ src/includes/forums/functions.php @@ -186,40 +186,34 @@ /** Forum Parent **********************************************************/ - // Forum parent was passed (the norm) - if ( ! empty( $_POST['bbp_forum_parent_id'] ) ) { + // Forum parent is expected for theme-side submissions + if ( ! empty( $_POST['bbp_forum_parent_id'] ) && is_numeric( $_POST['bbp_forum_parent_id'] ) ) { $forum_parent_id = bbp_get_forum_id( $_POST['bbp_forum_parent_id'] ); } // Filter and sanitize $forum_parent_id = apply_filters( 'bbp_new_forum_pre_parent_id', $forum_parent_id ); - // No forum parent was passed (should never happen) + // Forum parent was not passed (required for theme-side BuddyPress support) if ( empty( $forum_parent_id ) ) { bbp_add_error( 'bbp_new_forum_missing_parent', __( 'Error: Your forum must have a parent.', 'bbpress' ) ); - // Forum exists + // Forum parent exists } elseif ( ! empty( $forum_parent_id ) ) { - // Forum is a category - if ( bbp_is_forum_category( $forum_parent_id ) ) { - bbp_add_error( 'bbp_new_forum_forum_category', __( 'Error: This forum is a category. No forums can be created in this forum.', 'bbpress' ) ); - } + // Forum parent not editable by user + if ( ! current_user_can( 'edit_forum', $forum_parent_id ) ) { - // Forum is closed and user cannot access - if ( bbp_is_forum_closed( $forum_parent_id ) && ! current_user_can( 'edit_forum', $forum_parent_id ) ) { - bbp_add_error( 'bbp_new_forum_forum_closed', __( 'Error: This forum has been closed to new forums.', 'bbpress' ) ); + // Forum parent is closed + if ( bbp_is_forum_closed( $forum_parent_id ) ) { + bbp_add_error( 'bbp_new_forum_forum_closed', __( 'Error: This forum is closed to new forums.', 'bbpress' ) ); + } } - // Forum is private and user cannot access - if ( bbp_is_forum_private( $forum_parent_id ) && ! current_user_can( 'read_forum', $forum_parent_id ) ) { - bbp_add_error( 'bbp_new_forum_forum_private', __( 'Error: This forum is private and you do not have the capability to read or create new forums in it.', 'bbpress' ) ); + // Forum parent not readable by user + if ( ! current_user_can( 'read_forum', $forum_parent_id ) ) { + bbp_add_error( 'bbp_new_forum_forum_read', __( 'Error: You do not have the capability to create new forums in this forum.', 'bbpress' ) ); } - - // Forum is hidden and user cannot access - if ( bbp_is_forum_hidden( $forum_parent_id ) && ! current_user_can( 'read_forum', $forum_parent_id ) ) { - bbp_add_error( 'bbp_new_forum_forum_hidden', __( 'Error: This forum is hidden and you do not have the capability to read or create new forums in it.', 'bbpress' ) ); - } } /** Forum Flooding ********************************************************/ @@ -428,29 +422,28 @@ /** Forum Parent ***********************************************************/ // Forum parent id was passed - if ( ! empty( $_POST['bbp_forum_parent_id'] ) ) { + if ( ! empty( $_POST['bbp_forum_parent_id'] ) && is_numeric( $_POST['bbp_forum_parent_id'] ) ) { $forum_parent_id = bbp_get_forum_id( $_POST['bbp_forum_parent_id'] ); } // Current forum this forum is in $current_parent_forum_id = bbp_get_forum_parent_id( $forum_id ); - // Forum exists + // Forum parent exists if ( ! empty( $forum_parent_id ) && ( $forum_parent_id !== $current_parent_forum_id ) ) { - // Forum is closed and user cannot access - if ( bbp_is_forum_closed( $forum_parent_id ) && ! current_user_can( 'edit_forum', $forum_parent_id ) ) { - bbp_add_error( 'bbp_edit_forum_forum_closed', __( 'Error: This forum has been closed to new forums.', 'bbpress' ) ); - } + // Forum parent not editable by user + if ( ! current_user_can( 'edit_forum', $forum_parent_id ) ) { - // Forum is private and user cannot access - if ( bbp_is_forum_private( $forum_parent_id ) && ! current_user_can( 'read_forum', $forum_parent_id ) ) { - bbp_add_error( 'bbp_edit_forum_forum_private', __( 'Error: This forum is private and you do not have the capability to read or create new forums in it.', 'bbpress' ) ); + // Forum is closed + if ( bbp_is_forum_closed( $forum_parent_id ) ) { + bbp_add_error( 'bbp_edit_forum_forum_closed', __( 'Error: This forum is closed to new forums.', 'bbpress' ) ); + } } - // Forum is hidden and user cannot access - if ( bbp_is_forum_hidden( $forum_parent_id ) && ! current_user_can( 'read_forum', $forum_parent_id ) ) { - bbp_add_error( 'bbp_edit_forum_forum_hidden', __( 'Error: This forum is hidden and you do not have the capability to read or create new forums in it.', 'bbpress' ) ); + // Forum parent not readable by user + if ( ! current_user_can( 'read_forum', $forum_parent_id ) ) { + bbp_add_error( 'bbp_edit_forum_forum_read', __( 'Error: You do not have the capability to create new forums in this forum.', 'bbpress' ) ); } } Index: src/includes/replies/capabilities.php --- src/includes/replies/capabilities.php +++ src/includes/replies/capabilities.php @@ -51,7 +51,7 @@ case 'read_reply' : // User cannot spectate - if ( ! user_can( $user_id, 'spectate' ) ) { + if ( ! user_can( $user_id, 'spectate' ) && ! bbp_is_anonymous() ) { $caps = array( 'do_not_allow' ); // Do some post ID based logic @@ -71,8 +71,16 @@ // Post is public if ( bbp_get_public_status_id() === $_post->post_status ) { - $caps = array( 'spectate' ); + // Anonymous users do not have caps, but can 'exist' + if ( bbp_is_anonymous() ) { + $caps = array( 'exist' ); + + // Registered users need the 'spectate' cap + } else { + $caps = array( 'spectate' ); + } + // User is author so allow read } elseif ( (int) $user_id === (int) $_post->post_author ) { $caps = array( 'spectate' ); Index: src/includes/replies/functions.php --- src/includes/replies/functions.php +++ src/includes/replies/functions.php @@ -179,8 +179,12 @@ // Get the topic id $posted_topic_id = intval( $_POST['bbp_topic_id'] ); + // Topic id is 0 + if ( 0 === $posted_topic_id ) { + bbp_add_error( 'bbp_reply_topic_id', __( 'Error: Topic ID is missing.', 'bbpress' ) ); + // Topic id is a negative number - if ( 0 > $posted_topic_id ) { + } elseif ( 0 > $posted_topic_id ) { bbp_add_error( 'bbp_reply_topic_id', __( 'Error: Topic ID cannot be a negative number.', 'bbpress' ) ); // Topic does not exist @@ -193,6 +197,11 @@ } } + // User cannot read parent topic ID + if ( ! current_user_can( 'read_topic', $topic_id ) ) { + bbp_add_error( 'bbp_new_reply_topic_public', __( 'Error: You do not have the capability to read or create new replies in this topic.', 'bbpress' ) ); + } + /** Forum ID **************************************************************/ // Try to use the forum id of the topic @@ -216,17 +225,17 @@ // Get the forum id $posted_forum_id = intval( $_POST['bbp_forum_id'] ); - // Forum id is empty + // Forum id is 0 if ( 0 === $posted_forum_id ) { - bbp_add_error( 'bbp_topic_forum_id', __( 'Error: Forum ID is missing.', 'bbpress' ) ); + bbp_add_error( 'bbp_reply_forum_id', __( 'Error: Forum ID is missing.', 'bbpress' ) ); // Forum id is a negative number } elseif ( 0 > $posted_forum_id ) { - bbp_add_error( 'bbp_topic_forum_id', __( 'Error: Forum ID cannot be a negative number.', 'bbpress' ) ); + bbp_add_error( 'bbp_reply_forum_id', __( 'Error: Forum ID cannot be a negative number.', 'bbpress' ) ); // Forum does not exist } elseif ( ! bbp_get_forum( $posted_forum_id ) ) { - bbp_add_error( 'bbp_topic_forum_id', __( 'Error: Forum does not exist.', 'bbpress' ) ); + bbp_add_error( 'bbp_reply_forum_id', __( 'Error: Forum does not exist.', 'bbpress' ) ); // Use the POST'ed forum id } else { @@ -245,18 +254,18 @@ // Forum is not a category } else { - // Forum is closed and user cannot access - if ( bbp_is_forum_closed( $forum_id ) && ! current_user_can( 'edit_forum', $forum_id ) ) { - bbp_add_error( 'bbp_new_reply_forum_closed', __( 'Error: This forum has been closed to new replies.', 'bbpress' ) ); + // Forum not editable by user + if ( ! current_user_can( 'edit_forum', $forum_id ) ) { + + // Forum is closed + if ( bbp_is_forum_closed( $forum_id ) ) { + bbp_add_error( 'bbp_new_reply_forum_closed', __( 'Error: This forum is closed to new replies.', 'bbpress' ) ); + } } - // Forum is private and user cannot access - if ( bbp_is_forum_private( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_new_reply_forum_private', __( 'Error: This forum is private and you do not have the capability to read or create new replies in it.', 'bbpress' ) ); - - // Forum is hidden and user cannot access - } elseif ( bbp_is_forum_hidden( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_new_reply_forum_hidden', __( 'Error: This forum is hidden and you do not have the capability to read or create new replies in it.', 'bbpress' ) ); + // Forum not readable by user + if ( ! current_user_can( 'read_forum', $forum_id ) ) { + bbp_add_error( 'bbp_new_reply_forum_read', __( 'Error: You do not have the capability to read or create new replies in this forum.', 'bbpress' ) ); } } } @@ -270,6 +279,22 @@ remove_filter( 'bbp_new_reply_pre_content', 'bbp_filter_kses', 30 ); } + /** Reply To **************************************************************/ + + // Handle Reply To of the reply; $_REQUEST for non-JS submissions + if ( isset( $_REQUEST['bbp_reply_to'] ) && is_numeric( $_REQUEST['bbp_reply_to'] ) ) { + $reply_to = bbp_validate_reply_to( $_REQUEST['bbp_reply_to'] ); + } + + // Check the Reply To ID + if ( ! empty( $reply_to ) ) { + + // User cannot read parent reply ID + if ( ! current_user_can( 'read_reply', $reply_to ) ) { + bbp_add_error( 'bbp_new_reply_reply_to', __( 'Error: You do not have the capability to read or create new replies to this reply.', 'bbpress' ) ); + } + } + /** Reply Title ***********************************************************/ if ( ! empty( $_POST['bbp_reply_title'] ) ) { @@ -334,13 +359,6 @@ $reply_status = bbp_get_pending_status_id(); } - /** Reply To **************************************************************/ - - // Handle Reply To of the reply; $_REQUEST for non-JS submissions - if ( isset( $_REQUEST['bbp_reply_to'] ) ) { - $reply_to = bbp_validate_reply_to( $_REQUEST['bbp_reply_to'] ); - } - /** Topic Closed **********************************************************/ // If topic is closed, moderators can still reply @@ -574,6 +592,11 @@ $topic_id = bbp_get_reply_topic_id( $reply_id ); + // User cannot read parent topic ID + if ( ! current_user_can( 'read_topic', $topic_id ) ) { + bbp_add_error( 'bbp_edit_reply_topic', __( 'Error: You do not have the capability to read or create new replies in this topic.', 'bbpress' ) ); + } + /** Topic Forum ***********************************************************/ $forum_id = bbp_get_topic_forum_id( $topic_id ); @@ -588,22 +611,43 @@ // Forum is not a category } else { - // Forum is closed and user cannot access - if ( bbp_is_forum_closed( $forum_id ) && ! current_user_can( 'edit_forum', $forum_id ) ) { - bbp_add_error( 'bbp_edit_reply_forum_closed', __( 'Error: This forum has been closed to new replies.', 'bbpress' ) ); + // Forum not editable by user + if ( ! current_user_can( 'edit_forum', $forum_id ) ) { + + // Forum is closed + if ( bbp_is_forum_closed( $forum_id ) ) { + bbp_add_error( 'bbp_edit_reply_forum_closed', __( 'Error: This forum is closed to new replies.', 'bbpress' ) ); + } } - // Forum is private and user cannot access - if ( bbp_is_forum_private( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_edit_reply_forum_private', __( 'Error: This forum is private and you do not have the capability to read or create new replies in it.', 'bbpress' ) ); - - // Forum is hidden and user cannot access - } elseif ( bbp_is_forum_hidden( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_edit_reply_forum_hidden', __( 'Error: This forum is hidden and you do not have the capability to read or create new replies in it.', 'bbpress' ) ); + // Forum not readable by user + if ( ! current_user_can( 'read_forum', $forum_id ) ) { + bbp_add_error( 'bbp_edit_reply_forum_read', __( 'Error: You do not have the capability to read or create new replies in this forum.', 'bbpress' ) ); } } } + /** Reply To **************************************************************/ + + $reply_to = bbp_get_reply_to( $reply_id ); + + // Maybe sanitize Reply To, using $_REQUEST for non-JS submissions + if ( isset( $_REQUEST['bbp_reply_to'] ) && is_numeric( $_REQUEST['bbp_reply_to'] ) ) { + $reply_to = intval( $_REQUEST['bbp_reply_to'] ); + } + + // Validate Reply To + $reply_to = bbp_validate_reply_to( $reply_to, $reply_id ); + + // Check the Reply To ID + if ( ! empty( $reply_to ) ) { + + // User cannot read parent reply ID + if ( ! current_user_can( 'read_reply', $reply_to ) ) { + bbp_add_error( 'bbp_edit_reply_reply_to', __( 'Error: You do not have the capability to read or create new replies to this reply.', 'bbpress' ) ); + } + } + /** Reply Title ***********************************************************/ if ( ! empty( $_POST['bbp_reply_title'] ) ) { @@ -663,15 +707,6 @@ } } - /** Reply To **************************************************************/ - - // Handle Reply To of the reply; $_REQUEST for non-JS submissions - if ( isset( $_REQUEST['bbp_reply_to'] ) && current_user_can( 'moderate', $reply_id ) ) { - $reply_to = bbp_validate_reply_to( $_REQUEST['bbp_reply_to'], $reply_id ); - } elseif ( bbp_thread_replies() ) { - $reply_to = bbp_get_reply_to( $reply_id ); - } - /** Topic Tags ************************************************************/ // Either replace terms Index: src/includes/topics/capabilities.php --- src/includes/topics/capabilities.php +++ src/includes/topics/capabilities.php @@ -71,7 +71,7 @@ case 'read_topic' : // User cannot spectate - if ( ! user_can( $user_id, 'spectate' ) ) { + if ( ! user_can( $user_id, 'spectate' ) && ! bbp_is_anonymous() ) { $caps = array( 'do_not_allow' ); // Do some post ID based logic @@ -91,8 +91,16 @@ // Post is public if ( bbp_get_public_status_id() === $_post->post_status ) { - $caps = array( 'spectate' ); + // Anonymous users do not have caps, but can 'exist' + if ( bbp_is_anonymous() ) { + $caps = array( 'exist' ); + + // Registered users need the 'spectate' cap + } else { + $caps = array( 'spectate' ); + } + // User is author so allow read } elseif ( (int) $user_id === (int) $_post->post_author ) { $caps = array( 'spectate' ); Index: src/includes/topics/functions.php --- src/includes/topics/functions.php +++ src/includes/topics/functions.php @@ -196,7 +196,7 @@ // Get the forum id $posted_forum_id = intval( $_POST['bbp_forum_id'] ); - // Forum id is empty + // Forum id is 0 if ( 0 === $posted_forum_id ) { bbp_add_error( 'bbp_topic_forum_id', __( 'Error: Forum ID is missing.', 'bbpress' ) ); @@ -225,18 +225,18 @@ // Forum is not a category } else { - // Forum is closed and user cannot access - if ( bbp_is_forum_closed( $forum_id ) && ! current_user_can( 'edit_forum', $forum_id ) ) { - bbp_add_error( 'bbp_new_topic_forum_closed', __( 'Error: This forum has been closed to new topics.', 'bbpress' ) ); + // Forum not editable by user + if ( ! current_user_can( 'edit_forum', $forum_id ) ) { + + // Forum is closed + if ( bbp_is_forum_closed( $forum_id ) ) { + bbp_add_error( 'bbp_new_topic_forum_closed', __( 'Error: This forum is closed to new topics.', 'bbpress' ) ); + } } - // Forum is private and user cannot access - if ( bbp_is_forum_private( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_new_topic_forum_private', __( 'Error: This forum is private and you do not have the capability to read or create new topics in it.', 'bbpress' ) ); - - // Forum is hidden and user cannot access - } elseif ( bbp_is_forum_hidden( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_new_topic_forum_hidden', __( 'Error: This forum is hidden and you do not have the capability to read or create new topics in it.', 'bbpress' ) ); + // Forum not readable by user + if ( ! current_user_can( 'read_forum', $forum_id ) ) { + bbp_add_error( 'bbp_new_topic_forum_read', __( 'Error: You do not have the capability to read or create new topics in this forum.', 'bbpress' ) ); } } } @@ -499,14 +499,46 @@ // Forum id was passed } elseif ( is_numeric( $_POST['bbp_forum_id'] ) ) { - $forum_id = (int) $_POST['bbp_forum_id']; + + // Get the forum id + $posted_forum_id = intval( $_POST['bbp_forum_id'] ); + + // Forum id is 0 + if ( 0 === $posted_forum_id ) { + bbp_add_error( 'bbp_topic_forum_id', __( 'Error: Forum ID is missing.', 'bbpress' ) ); + + // Forum id is a negative number + } elseif ( 0 > $posted_forum_id ) { + bbp_add_error( 'bbp_topic_forum_id', __( 'Error: Forum ID cannot be a negative number.', 'bbpress' ) ); + + // Forum does not exist + } elseif ( ! bbp_get_forum( $posted_forum_id ) ) { + bbp_add_error( 'bbp_topic_forum_id', __( 'Error: Forum does not exist.', 'bbpress' ) ); + + // Use the POST'ed forum id + } else { + $forum_id = $posted_forum_id; + } } // Current forum this topic is in $current_forum_id = bbp_get_topic_forum_id( $topic_id ); + // Forum change + if ( $forum_id !== $current_forum_id ) { + + // User cannot edit current forum + if ( ! current_user_can( 'edit_forum', $current_forum_id ) ) { + bbp_add_error( 'bbp_edit_topic_forum_move_old', __( 'Error: You do not have the capability to move topics out of this forum.', 'bbpress' ) ); + + // User cannot read new forum + } elseif ( ! current_user_can( 'read_forum', $forum_id ) ) { + bbp_add_error( 'bbp_edit_topic_forum_move_new', __( 'Error: You do not have the capability to move topics into this forum.', 'bbpress' ) ); + } + } + // Forum exists - if ( ! empty( $forum_id ) && ( $forum_id !== $current_forum_id ) ) { + if ( ! empty( $forum_id ) ) { // Forum is a category if ( bbp_is_forum_category( $forum_id ) ) { @@ -515,18 +547,18 @@ // Forum is not a category } else { - // Forum is closed and user cannot access - if ( bbp_is_forum_closed( $forum_id ) && ! current_user_can( 'edit_forum', $forum_id ) ) { - bbp_add_error( 'bbp_edit_topic_forum_closed', __( 'Error: This forum has been closed to new topics.', 'bbpress' ) ); + // Forum not editable by user + if ( ! current_user_can( 'edit_forum', $forum_id ) ) { + + // Forum is closed + if ( bbp_is_forum_closed( $forum_id ) ) { + bbp_add_error( 'bbp_edit_topic_forum_closed', __( 'Error: This forum is closed to new topics.', 'bbpress' ) ); + } } - // Forum is private and user cannot access - if ( bbp_is_forum_private( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_edit_topic_forum_private', __( 'Error: This forum is private and you do not have the capability to read or create new topics in it.', 'bbpress' ) ); - - // Forum is hidden and user cannot access - } elseif ( bbp_is_forum_hidden( $forum_id ) && ! current_user_can( 'read_forum', $forum_id ) ) { - bbp_add_error( 'bbp_edit_topic_forum_hidden', __( 'Error: This forum is hidden and you do not have the capability to read or create new topics in it.', 'bbpress' ) ); + // Forum not readable by user + if ( ! current_user_can( 'read_forum', $forum_id ) ) { + bbp_add_error( 'bbp_edit_topic_forum_read', __( 'Error: You do not have the capability to read or create new topics in this forum.', 'bbpress' ) ); } } }