Skip to:
Content

bbPress.org

Opened 7 months ago

Closed 7 months ago

#3650 closed enhancement (fixed)

Check caps on parent objects in new/edit handlers

Reported by: johnjamesjacoby's profile johnjamesjacoby Owned by: johnjamesjacoby's profile johnjamesjacoby
Milestone: 2.7 Priority: high
Severity: normal Version: 2.0
Component: Component - Any/All Keywords: needs-patch
Cc:

Description

When creating or editing any forum/topic/reply, we do not currently perform any capability checks on the parent IDs in the following functions:

  • bbp_new_reply_handler
  • bbp_edit_reply_handler
  • bbp_new_topic_handler
  • bbp_edit_topic_handler
  • bbp_new_forum_handler
  • bbp_edit_forum_handler

Luckily, bbPress protects against this causing any problems in a number of other ways later in the code execution path of these post actions and their template parts.

That being said, I think it's worth checking for, and adding error messages for as well.

Attachments (3)

3650.diff (19.4 KB) - added by johnjamesjacoby 7 months ago.
3650-2.diff (21.4 KB) - added by johnjamesjacoby 7 months ago.
Map anonymous users to 'spectate' in 2 more places
3650-3.diff (21.5 KB) - added by johnjamesjacoby 7 months ago.
Same as -2, but allows capable users to create new forums under parent categories

Download all attachments as: .zip

Change History (4)

@johnjamesjacoby
7 months ago

Map anonymous users to 'spectate' in 2 more places

@johnjamesjacoby
7 months ago

Same as -2, but allows capable users to create new forums under parent categories

#1 @johnjamesjacoby
7 months ago

  • Resolution set to fixed
  • Status changed from assigned to closed

In 7350:

Forums/Topics/Replies: Add capability checks for parent object IDs when users are creating & editing content theme-side.

This change introduces a series of matching capability checks to the new/edit handler functions, that ensure the currently logged in user can read the proposed parent location for their content.

This change includes checks for anonymous users (when enabled) mapping "read" checks for public forums/topics/replies to exist so they can continue to post the same as before.

It also removes a few private/hidden error messages and replaces them with more generic phasing, to minimize leakage about content that is not publicly accessible.

The intent with these changes is to account for and trap any mismatches between where content handler functions are listening vs. what the user has access to create new content inside of – if they cannot read it, they cannot create new content in it, and will now see errors letting them know.

In trunk, for 2.7.

Fixes #3650.

Note: See TracTickets for help on using tickets.