About: dobbiedada

Please note I took a backup before I did the next part:

As mentioned in the previous post, I have set up buddypress hidden groups and bbpress hidden forums so that if you are not a member of a given forum you can’t see forum, or even see the existence of the forum (for example via the [bbp-forum-index] shortcode). I have put trying to integrate s2member with buddypress groups on hold while I try to figure out the following problem:

I have noticed that installing s2member makes the bbp-forum-index shortcode behave differently unless you are an admin or a keymaster.

To an admin or keymaster (you don’t need both, just one or the other), the bbp-forum-index shortcode shows:

Group Forums
Cancer Support Group (4,2), HIV Positive Support Group (3,1)

E.g. you can see all the hidden groups.

Someone who knows more about HTML looked at the bbp-forum-index shortcode and ascertained it was finding privileges via the current_user_can functionality. They helped me install some debug code when the shortcode is executed to print out the results of the current_user_can function for various conditions. In the case of someone who is an Administrator OR a Keymaster, the debug code displays:

current_user_can( ‘read_hidden_forums’ ): YES
current_user_can( ‘read_private_forums’ ): YES
About to call bbp_has_forums()
bbp_has_forums() returned TRUE

Prior to installing s2member, in the case of someone who has neither Administrator or Keymaster (for example someone who is both a subscriber AND a buddypress participant) they used to see:

Group Forums
Cancer Support Group (4,2)

However, after installing s2member, the person in the cancer survivor support group sees only:

Group Forums

E.g. the support group they have access to is not shown. In this situation the debug code displays:

current_user_can( ‘read_hidden_forums’ ): NO
current_user_can( ‘read_private_forums’ ): YES
About to call bbp_has_forums()
bbp_has_forums() returned TRUE

HOWEVER, even after installing s2member which caused the bbp-forum-index shortcode to not return the forums that the user has access to, if that user (who legitimately has access to the cancer-survivor-support-group forum) types in the link for the URL directly into the browser, e.g. myurl.com/groups/cancer-support-group/forum/ they DO get to the forum. If someone NOT in the cancer-survivor support group forum types in that same link, they do NOT get to the forum. So even though the bbp-forum-index shortcode is not working, bbpress and buddypress are still doing their thing in the background, protecting the forums from being seen by people who aren’t supposed to see them.

I wondered if somehow s2member had wiped out some capabilities for my users or buddypress hidden groups, so I installed the ‘capability manager enhanced’ as per http://www.s2member.com/forums/topic/dont-upgrade-to-bbpress-2-2/#post34350 because I wanted to see the capabilities (rather than edit them) and I discovered that:

Administrators do NOT have ‘read hidden forums’ privilege (e.g. if you just load the ‘administrator’ capabilities in ‘capability manager enhanced’ and just look at them, ‘read hidden forums’ is not checked). ‘Read hidden forums’ is conferred through the Keymaster role, not the Administrator role (e.g. when you load the Keymaster role in ‘capability manager enhanced’ and just look at it, you see that it does indeed have ‘read hidden forums’ checked).

Note that I checked that the Administrator privileges by themselves was indeed conferring the capability to execute the bbp-forum-index shortcode (and return YES to the current_user_can(‘read_hidden_forums’) procedure) by creating a user that had ONLY Administrator role and NOT Keymaster role, and when that user executes the bbp-forum-index shortcode they see:

Group Forums
Cancer Support Group (4,2), HIV Positive Support Group (3,1)

So they can see all the hidden groups on the screen, just like the Keymasters, and the debug code when executing the bbp-forum-index shortcode for the Administrator-but-not-Keymaster shows:

current_user_can( ‘read_hidden_forums’ ): YES
current_user_can( ‘read_private_forums’ ): YES
About to call bbp_has_forums()
bbp_has_forums() returned TRUE

So even though ‘capability manager enhanced’ shows that an administrator does NOT have ‘read hidden forums’ privilege, and that user does not have the Keymaster privilege, the current_user_can(‘read_hidden_forums’) is returning true.

Note again that if someone that has neither Administrator OR Keymaster and only has Subscriber and Participant roles, although the bbp-forum-index shortcode shows only ‘Group Forums’ but not their forums, and the debug code shows that ‘current_user_can(‘read_hidden_forums’) is returning NO, they CAN access the forum they have been added to by typing the URL directly in the address bar (e.g. myurl.com/groups/cancer-support-group/forum/ or whatever) they DO get to the forum, and if someone that hasn’t been added to that hidden forum tries the same URL they DON”T get to the forum. So again, I want to make it clear, buddypress and bbpress are still protecting the forums, it’s only the shortcode that won’t work.

I also experimented with adding ‘read hidden forums’ via ‘capability manager enhanced’ (again, note that I took a backup before I started doing any of this :-)) and I noticed that if I use ‘capability manager enhanced’ to ADD the ‘read hidden forums’ to the subscriber or participant roles and then reload it (after saving), it does indeed show that the capability for ‘read hidden forums’ has been added to the role. However, if I re-sync s2member using the ‘other integrations’->’bbpress plugin integration’ and then ‘update roles/capabilities’ and then reload whatever role I added ‘read hidden forums’ to, it has been unchecked by the ‘update roles/capabilities’ button. I’m mentioning this only because I’m surprised it wiped the value out. And I can easily go back to the backup I took before I edited the ‘capability manager enhanced’. This was just an experiment to see if I could make the bbp-forum-index shortcode work, and I don’t want to distract from the information above by mentioning this.

Any advice on how to get my bbp-forum-index shortcode to work (e.g. how to make current_user_can understand that indeed, the user can access the hidden forum that they have access to) would be gratefully recieved!