S2 Member Integration with Buddypress Groups

I have debugged some problems since my previous query so I have substantially re-written this post several times – I hope that hasn’t caused any confusion to the support folks.

Apologies if this is a stupid question, I’m very new to s2member.

This is a new install of wordpress/buddypress/bbpress/s2member, so everything is the latest version.

I should mention I did look at the forum links prior to posting, my apologies if I have missed something basic.

I would like to ask advice about what s2member mechanisms to use to enable the following scenario:

I would like people to be able to sign up on my registration page and request access to particular forums. They wouldn’t be able to access the forums until they were approved.

E.g.:

Cancer Survivors Support Group Forum.
JMML Sufferers Support Group Forum.
HIV-Positive Support Group Forum.
Etc.

There will be many forums eventually, perhaps dozens.

Users with privileges to access one forum should NOT be able to see forums to which they don’t have privileges.

Note that this is NOT the usual “if you have access to level 2 you also have access to level 1 and level 0 – if you are suffering from JMML you aren’t necessarily also a cancer survivor, etc. It’s a situation where people would request access to particular forums but wouldn’t actually get access until a moderator approved them. It’s possible that someone would have access to two forums (someone might have survived cancer and also be HIV-positive etc), but it would not be the general case, and it would be fine if they had to apply separately to each forum.

Initially the membership would be free but it’s possible that there would eventually be a flat fee for access (the fee would not differentiated by membership level or forum).

Currently I’m using buddypress hidden groups that are associated with bbpress forums, and it works ok. E.g. if you are in the hidden group for JMML sufferers, you can only see the forum for JMML sufferers and no other forums. However, the reason for wanting to integrate with s2member is so that I can automate the sign-up, and have the users request access to different forums. So I’d like to know what would be the most sensible mechanism for making the sign-up assign the buddypress hidden group information (is that a use case for ‘custom capabilities’), and what would be the most sensible mechanism for not allowing ‘immediate’ access, e.g. access is only granted once a moderator approves?

Any pointers would be gratefully recieved, and my apologies if I’m missing something basic cos I’m a noob!

Well, the only restriction you could use there would be the URI or Page restrictions, but they are both based on the user level. But you need something like the custom capabilities, which aren’t usable to restrict bbPress or BuddyPress groups yet…

You may be able if you create a hack/customization, but that’s really up to you or someone you hire to implement it. I haven’t tried this customization yet, so I’m not ready to suggest anything, but these may help:
Video » s2Member (Custom Capabilities)
Knowledge Base » Hacking s2Member® Via Hooks/Filters

Please note I took a backup before I did the next part:

As mentioned in the previous post, I have set up buddypress hidden groups and bbpress hidden forums so that if you are not a member of a given forum you can’t see forum, or even see the existence of the forum (for example via the [bbp-forum-index] shortcode). I have put trying to integrate s2member with buddypress groups on hold while I try to figure out the following problem:

I have noticed that installing s2member makes the bbp-forum-index shortcode behave differently unless you are an admin or a keymaster.

To an admin or keymaster (you don’t need both, just one or the other), the bbp-forum-index shortcode shows:

Group Forums
Cancer Support Group (4,2), HIV Positive Support Group (3,1)

E.g. you can see all the hidden groups.

Someone who knows more about HTML looked at the bbp-forum-index shortcode and ascertained it was finding privileges via the current_user_can functionality. They helped me install some debug code when the shortcode is executed to print out the results of the current_user_can function for various conditions. In the case of someone who is an Administrator OR a Keymaster, the debug code displays:

current_user_can( ‘read_hidden_forums’ ): YES
current_user_can( ‘read_private_forums’ ): YES
About to call bbp_has_forums()
bbp_has_forums() returned TRUE

Prior to installing s2member, in the case of someone who has neither Administrator or Keymaster (for example someone who is both a subscriber AND a buddypress participant) they used to see:

Group Forums
Cancer Support Group (4,2)

However, after installing s2member, the person in the cancer survivor support group sees only:

Group Forums

E.g. the support group they have access to is not shown. In this situation the debug code displays:

current_user_can( ‘read_hidden_forums’ ): NO
current_user_can( ‘read_private_forums’ ): YES
About to call bbp_has_forums()
bbp_has_forums() returned TRUE

HOWEVER, even after installing s2member which caused the bbp-forum-index shortcode to not return the forums that the user has access to, if that user (who legitimately has access to the cancer-survivor-support-group forum) types in the link for the URL directly into the browser, e.g. myurl.com/groups/cancer-support-group/forum/ they DO get to the forum. If someone NOT in the cancer-survivor support group forum types in that same link, they do NOT get to the forum. So even though the bbp-forum-index shortcode is not working, bbpress and buddypress are still doing their thing in the background, protecting the forums from being seen by people who aren’t supposed to see them.

I wondered if somehow s2member had wiped out some capabilities for my users or buddypress hidden groups, so I installed the ‘capability manager enhanced’ as per http://www.s2member.com/forums/topic/dont-upgrade-to-bbpress-2-2/#post34350 because I wanted to see the capabilities (rather than edit them) and I discovered that:

Administrators do NOT have ‘read hidden forums’ privilege (e.g. if you just load the ‘administrator’ capabilities in ‘capability manager enhanced’ and just look at them, ‘read hidden forums’ is not checked). ‘Read hidden forums’ is conferred through the Keymaster role, not the Administrator role (e.g. when you load the Keymaster role in ‘capability manager enhanced’ and just look at it, you see that it does indeed have ‘read hidden forums’ checked).

Note that I checked that the Administrator privileges by themselves was indeed conferring the capability to execute the bbp-forum-index shortcode (and return YES to the current_user_can(‘read_hidden_forums’) procedure) by creating a user that had ONLY Administrator role and NOT Keymaster role, and when that user executes the bbp-forum-index shortcode they see:

Group Forums
Cancer Support Group (4,2), HIV Positive Support Group (3,1)

So they can see all the hidden groups on the screen, just like the Keymasters, and the debug code when executing the bbp-forum-index shortcode for the Administrator-but-not-Keymaster shows:

current_user_can( ‘read_hidden_forums’ ): YES
current_user_can( ‘read_private_forums’ ): YES
About to call bbp_has_forums()
bbp_has_forums() returned TRUE

So even though ‘capability manager enhanced’ shows that an administrator does NOT have ‘read hidden forums’ privilege, and that user does not have the Keymaster privilege, the current_user_can(‘read_hidden_forums’) is returning true.

Note again that if someone that has neither Administrator OR Keymaster and only has Subscriber and Participant roles, although the bbp-forum-index shortcode shows only ‘Group Forums’ but not their forums, and the debug code shows that ‘current_user_can(‘read_hidden_forums’) is returning NO, they CAN access the forum they have been added to by typing the URL directly in the address bar (e.g. myurl.com/groups/cancer-support-group/forum/ or whatever) they DO get to the forum, and if someone that hasn’t been added to that hidden forum tries the same URL they DON”T get to the forum. So again, I want to make it clear, buddypress and bbpress are still protecting the forums, it’s only the shortcode that won’t work.

I also experimented with adding ‘read hidden forums’ via ‘capability manager enhanced’ (again, note that I took a backup before I started doing any of this :-)) and I noticed that if I use ‘capability manager enhanced’ to ADD the ‘read hidden forums’ to the subscriber or participant roles and then reload it (after saving), it does indeed show that the capability for ‘read hidden forums’ has been added to the role. However, if I re-sync s2member using the ‘other integrations’->’bbpress plugin integration’ and then ‘update roles/capabilities’ and then reload whatever role I added ‘read hidden forums’ to, it has been unchecked by the ‘update roles/capabilities’ button. I’m mentioning this only because I’m surprised it wiped the value out. And I can easily go back to the backup I took before I edited the ‘capability manager enhanced’. This was just an experiment to see if I could make the bbp-forum-index shortcode work, and I don’t want to distract from the information above by mentioning this.

Any advice on how to get my bbp-forum-index shortcode to work (e.g. how to make current_user_can understand that indeed, the user can access the hidden forum that they have access to) would be gratefully recieved!

Thanks for your tests and detailed feedback. I’ll forward this to Jason to review it.

Cristián Lávaque said:
But you need something like the custom capabilities

Regarding what I said earlier about not being able to use ccaps to restrict access to bbPress, here’s a possible solution that Jason told me about: http://www.s2member.com/forums/topic/visitors-blocked-from-bbpress-why/#post-50991

However, if I re-sync s2member using the ‘other integrations’->’bbpress plugin integration’ and then ‘update roles/capabilities’ and then reload whatever role I added ‘read hidden forums’ to, it has been unchecked by the ‘update roles/capabilities’ button. I’m mentioning this only because I’m surprised it wiped the value out.

Please see this section of our KB article regarding the filter to lock-in your mods.
http://www.s2member.com/kb/roles-caps/#modifying-roles-caps