WordPress.org

Forums

bbPress - Private Replies
[resolved] Private reply visible (3 posts)

  1. dFactory
    Member
    Posted 1 year ago #

    Hi,

    There a dangerous problem - when users are allowed to post forum topics & replies without login / registration, replies set as private are visible to the public. It's beacuse unregistered topic author id = 0, and logout user id is also 0, ergo logout user = topic author, thus can view private replies

    Just change line 176 to this:

    if( ( $topic_author != $current_user->ID && $reply_author != $current_user->ID && current_user_can( 'publish_forums' ) == false ) || $current_user->ID == 0 ) {

    http://wordpress.org/extend/plugins/bbpress-private-replies/

  2. This has been resolved.

  3. dFactory
    Member
    Posted 1 year ago #

    Thank you.

Topic Closed

This topic has been closed to new replies.

About this Plugin

  • bbPress - Private Replies
  • Frequently Asked Questions
  • Support Threads
  • Reviews

About this Topic

Tags

No tags yet.