User sees 404 for hidden forum's topics, unless has edit_others_forums cap

[rzen]

A user with the read_hidden_forums cap can see a list of all hidden forums, but cannot see the topics. When clicking through to a hidden forum they are instead redirected to 404.

[rzen]

The user can read single topics/replies in the hidden forum without edit_others_forums, just cannot read the single forum page itself.

[pimarts]

I've got the same problem. Described here: http://bbpress.org/forums/topic/how-do-you-make-a-private-forum-visible-to-some-wordpress-classes#post-89350

Giving the user "edit_others_forums" cap didn't solve it for me though. I keep getting the 404 error.

Update/edit: After some hard refreshes it seemed to work with that cap in the end after all.

[johnjamesjacoby]

Moving to 2.0 to take a look at it.

[johnjamesjacoby]

Can we confirm this is still an issue on latest branch? I can't duplicate it, but that doesn't mean it doesn't exist.

[johnjamesjacoby]

Hidden cap test

[johnjamesjacoby]

Attached patch seems to confirm this issue is resolved.

Recommend deactivating and reactivating bbPress to flush the caps for good measure.

Reopen if you can duplicate this in a specific way.

[rzen]

Negative, running 2.0-rc2, deactivated and reactivated, users still require "edit_others_forums" cap to read a hidden forum. This is true for both a remote server and a local dev setup (completely fresh install). I can provide server access if you want to kick the tires on my remote install.

[johnjamesjacoby]

(In [3430]) Remove hierarchical check against private/hidden forum types. Fixes issue where a user needed to be able to view private forums in order to view hidden forums. See #1576.

[johnjamesjacoby]

(In [3431]) Perform correct cap check in bbp_forum_enforce_private(). See #1576 and r3430.

[johnjamesjacoby]

(In [3432]) Change hidden post status from protected to private, as we are now handling forum privacy scope manually. Fixes #1576.

[johnjamesjacoby]

(In [3434]) Additional sanity check in bbp_pre_get_posts() for forum queries, to hide forums the user is not capable of seeing. See #1576.