Skip to:
Content

bbPress.org

#3650 closed enhancement (fixed)

Check caps on parent objects in new/edit handlers

Reported by: johnjamesjacoby Owned by: johnjamesjacoby
Priority: high Milestone: 2.7
Component: Component - Any/All Version: 2.0
Severity: normal Keywords: needs-patch
Cc:

Description

When creating or editing any forum/topic/reply, we do not currently perform any capability checks on the parent IDs in the following functions:

  • bbp_new_reply_handler
  • bbp_edit_reply_handler
  • bbp_new_topic_handler
  • bbp_edit_topic_handler
  • bbp_new_forum_handler
  • bbp_edit_forum_handler

Luckily, bbPress protects against this causing any problems in a number of other ways later in the code execution path of these post actions and their template parts.

That being said, I think it's worth checking for, and adding error messages for as well.

Attachments (3)

3650.diff (19.4 KB ) - added by johnjamesjacoby 12 months ago.
3650-2.diff (21.4 KB ) - added by johnjamesjacoby 12 months ago.
Map anonymous users to 'spectate' in 2 more places
3650-3.diff (21.5 KB ) - added by johnjamesjacoby 12 months ago.
Same as -2, but allows capable users to create new forums under parent categories

Download all attachments as: .zip

Change History (4)

@johnjamesjacoby
12 months ago

Map anonymous users to 'spectate' in 2 more places

@johnjamesjacoby
12 months ago

Same as -2, but allows capable users to create new forums under parent categories

#1 @johnjamesjacoby
12 months ago

  • Resolutionfixed
  • Status assignedclosed

In 7350:

Forums/Topics/Replies: Add capability checks for parent object IDs when users are creating & editing content theme-side.

This change introduces a series of matching capability checks to the new/edit handler functions, that ensure the currently logged in user can read the proposed parent location for their content.

This change includes checks for anonymous users (when enabled) mapping "read" checks for public forums/topics/replies to exist so they can continue to post the same as before.

It also removes a few private/hidden error messages and replaces them with more generic phasing, to minimize leakage about content that is not publicly accessible.

The intent with these changes is to account for and trap any mismatches between where content handler functions are listening vs. what the user has access to create new content inside of – if they cannot read it, they cannot create new content in it, and will now see errors letting them know.

In trunk, for 2.7.

Fixes #3650.

Note: See TracTickets for help on using tickets.