Skip to:
Content

bbPress.org

Opened 4 days ago

Closed 4 days ago

Last modified 4 days ago

#3685 closed defect (bug) (fixed)

Super Moderator capabilities are unreachable from the profile they describe

Reported by: obenland Owned by: johnjamesjacoby
Priority: normal Milestone: Awaiting Review
Component: Component - Users Version:
Severity: normal Keywords: has-patch needs-testing has-unit-tests
Cc: obenland

Description

r7513 scoped the Super Moderator mapping in bbp_map_primary_meta_caps() to the front-end profile editor:

case 'edit_user'    :
case 'promote_user' :

        // Moderators can edit users if super moderators is enabled.
        if ( bbp_allow_super_mods() && ! is_admin() && bbp_is_single_user_edit() ) {

bbp_is_single_user_edit() is only true once you are on /users/<user>/edit/, so the capability cannot be tested from the profile that links to it. templates/default/bbpress/user-details.php renders its edit link behind

<?php if ( bbp_is_user_home() || current_user_can( 'edit_user', bbp_get_displayed_user_id() ) ) : ?>

which is now always false for a Super Moderator, so the link never appears. The editor itself still works if you type the URL. bbp_current_user_can_edit_user_field() inherits the same limit, because it defaults to current_user_can( 'edit_user', $user_id ) — a theme has no supported way to ask the question.

Reproduction, with Super Moderators enabled:

  1. Log in as a user with the Moderator forum role.
  2. Visit another user's profile.
  3. No edit link. /users/<user>/edit/ loads and saves normally.

The attached patch widens the scope to bbp_is_single_user(), which bbp_parse_query() sets on every single-user page, the editor included, so it is a strict superset of the current condition. wp-admin and unrelated pages stay excluded by the ! is_admin() check, and the target protections added in r7513 are untouched.

The patch also fixes the set_profile_editor() fixture in tests/.../users/functions/permissions.php, which set bbp_is_single_user_edit without bbp_is_single_user and so did not match what bbp_parse_query() produces, and adds a regression test covering the profile view, the protected targets, and wp-admin.

Reported downstream on the WordPress.org support forums, where moderators lost the profile edit link once this reached production.

Attachments (1)

super-mod-profile-view-scope.patch (3.3 KB ) - added by obenland 4 days ago.

Download all attachments as: .zip

Change History (4)

This ticket was mentioned in Slack in #meta by obenland617. View the logs.


4 days ago

#2 @johnjamesjacoby
4 days ago

  • Owner set to johnjamesjacoby
  • Resolutionfixed
  • Status newclosed

In 7564:

Users: Restore Super Moderator profile access.

Allow Super Moderators to edit and promote eligible users from bbPress front-end user screens, instead of only within the profile editor. Check bbPress's unfiltered query state to avoid widening the capability through BuddyPress member screens, while preserving wp-admin and protected-user restrictions.

In branches/2.6, for 2.6.18.

Fixes #3685.

#3 @johnjamesjacoby
4 days ago

In 7565:

Users: Restore Super Moderator profile access.

Allow Super Moderators to edit and promote eligible users from bbPress front-end user screens, instead of only within the profile editor. Check bbPress's unfiltered query state to avoid widening the capability through BuddyPress member screens, while preserving wp-admin and protected-user restrictions.

In trunk, for 2.7.

Fixes #3685.

Note: See TracTickets for help on using tickets.