#3685 closed defect (bug) (fixed)
Super Moderator capabilities are unreachable from the profile they describe
| Reported by: | obenland | Owned by: | johnjamesjacoby |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Component - Users | Version: | |
| Severity: | normal | Keywords: | has-patch needs-testing has-unit-tests |
| Cc: | obenland |
Description
r7513 scoped the Super Moderator mapping in bbp_map_primary_meta_caps() to the front-end profile editor:
case 'edit_user' : case 'promote_user' : // Moderators can edit users if super moderators is enabled. if ( bbp_allow_super_mods() && ! is_admin() && bbp_is_single_user_edit() ) {
bbp_is_single_user_edit() is only true once you are on /users/<user>/edit/, so the capability cannot be tested from the profile that links to it. templates/default/bbpress/user-details.php renders its edit link behind
<?php if ( bbp_is_user_home() || current_user_can( 'edit_user', bbp_get_displayed_user_id() ) ) : ?>
which is now always false for a Super Moderator, so the link never appears. The editor itself still works if you type the URL. bbp_current_user_can_edit_user_field() inherits the same limit, because it defaults to current_user_can( 'edit_user', $user_id ) — a theme has no supported way to ask the question.
Reproduction, with Super Moderators enabled:
- Log in as a user with the Moderator forum role.
- Visit another user's profile.
- No edit link.
/users/<user>/edit/loads and saves normally.
The attached patch widens the scope to bbp_is_single_user(), which bbp_parse_query() sets on every single-user page, the editor included, so it is a strict superset of the current condition. wp-admin and unrelated pages stay excluded by the ! is_admin() check, and the target protections added in r7513 are untouched.
The patch also fixes the set_profile_editor() fixture in tests/.../users/functions/permissions.php, which set bbp_is_single_user_edit without bbp_is_single_user and so did not match what bbp_parse_query() produces, and adds a regression test covering the profile view, the protected targets, and wp-admin.
Reported downstream on the WordPress.org support forums, where moderators lost the profile edit link once this reached production.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
In 7564: