<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> #2366 (Sticky escalation for non-moderators) – bbPress Trac </title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <!--[if IE]><script type="text/javascript"> if (/^#__msie303:/.test(window.location.hash)) window.location.replace(window.location.hash.replace(/^#__msie303:/, '#')); </script><![endif]--> <link rel="search" href="/search" /> <link rel="prev" href="/ticket/2365" title="Ticket #2365" /> <link rel="last" href="/ticket/3609" title="Ticket #3609" /> <link rel="help" href="/wiki/TracGuide" /> <link rel="alternate" href="/ticket/2366?format=csv" type="text/csv" class="csv" title="Comma-delimited Text" /> <link rel="alternate" href="/ticket/2366?format=tab" type="text/tab-separated-values" class="tab" title="Tab-delimited Text" /> <link rel="alternate" href="/ticket/2366?format=rss" type="application/rss+xml" class="rss" title="RSS Feed" /> <link rel="next" href="/ticket/2367" title="Ticket #2367" /> <link rel="start" href="/wiki" /> <link rel="stylesheet" href="https://s.w.org/style/trac/common/css/trac.css?v=220" /> <link rel="stylesheet" href="https://s.w.org/style/trac/common/css/ticket.css?v=220" /> <link rel="stylesheet" href="https://s.w.org/style/trac/common/css/jquery-ui/jquery-ui.css?v=220" /> <link rel="stylesheet" href="https://s.w.org/style/trac/common/css/jquery-ui-addons.css?v=220" /> <link rel="icon" href="https://bbpress.org/favicon.ico" type="image/x-icon" /> <link rel="first" href="/ticket/1" title="Ticket #1" /> <style id="trac-noscript" type="text/css">.trac-noscript { display: none !important }</style> <link type="application/opensearchdescription+xml" rel="search" href="/search/opensearch" title="Search bbPress Trac" /> <script type="text/javascript"> var auto_preview_timeout=2.0; var form_token="daa9afecdca90f0c50be48af"; var jquery_ui={"ampm":true,"date_format":"mm/dd/yy","day_names":{"abbreviated":["Sun","Mon","Tue","Wed","Thu","Fri","Sat"],"narrow":["Su","Mo","Tu","We","Th","Fr","Sa"],"wide":["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"]},"default_timezone":null,"first_week_day":0,"month_names":{"abbreviated":["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],"wide":["January","February","March","April","May","June","July","August","September","October","November","December"]},"period_names":{"am":["AM","AM"],"pm":["PM","PM"]},"show_timezone":false,"time_format":"hh:mm:ss TT","timepicker_separator":" ","timezone_iso8601":false,"timezone_list":null}; var comments_prefs={"comments_order":"oldest","show_comments":"true","show_prop_changes":"true"}; </script> <link rel="dns-prefetch" href="//fonts.googleapis.com" /> <link rel="dns-prefetch" href="//www.googletagmanager.com" /> <script>//<![CDATA[ (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-P24PF4B'); //]]></script> <link rel="stylesheet" href="//fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C300%2C400%2C600&subset=latin%2Clatin-ext&ver=3.8.1-alpha" type="text/css" media="all" /> <link type="text/css" media="screen" rel="stylesheet" href="//bbpress.org/wp-content/themes/bb-base/style.css?v=24" /> <link type="text/css" media="screen" rel="stylesheet" href="//bbpress.org/wp-content/themes/bb-base/style-bbpress.css?v=24" /> <meta name="viewport" content="width=device-width" /> <link rel="stylesheet" href="https://s.w.org/wp-includes/css/dashicons.min.css?20150710" type="text/css" /> <link rel="stylesheet" type="text/css" href="https://s.w.org/style/trac/wp-trac.css?220" /> <script src="https://s.w.org/style/trac/common/js/jquery.js?v=220"></script> <link rel="canonical" href="https://bbpress.trac.wordpress.org/ticket/2366" /> <script src="https://s.w.org/style/trac/common/js/babel.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/trac.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/search.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/folding.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/wikitoolbar.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/resizer.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/auto_preview.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/jquery-ui.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/jquery-ui-addons.js?v=220"></script> <script src="https://s.w.org/style/trac/common/js/jquery-ui-i18n.js?v=220"></script> <script type="text/javascript"> jQuery("#trac-noscript").remove(); jQuery(document).ready(function($) { $(".trac-autofocus").focus(); $(".trac-target-new").attr("target", "_blank"); if ($.ui) { /* is jquery-ui added? */ $(".trac-datepicker:not([readonly])").prop("autocomplete", "off").datepicker(); $(".trac-datetimepicker:not([readonly])").prop("autocomplete", "off").datetimepicker(); $("#main").addClass("trac-nodatetimehint"); } $(".trac-disable").disableSubmit(".trac-disable-determinant"); setTimeout(function() { $(".trac-scroll").scrollToTop() }, 1); $(".trac-disable-on-submit").disableOnSubmit(); }); </script> <script src="https://s.w.org/style/trac/common/js/threaded_comments.js?v=220"></script> <script type="text/javascript"> jQuery(document).ready(function($) { $("div.description").find("h1,h2,h3,h4,h5,h6").addAnchor(_("Link to this section")); $(".foldable").enableFolding(false, true); /*<![CDATA[*/ $("#attachments").toggleClass("collapsed"); $("#trac-up-attachments").click(function () { $("#attachments").removeClass("collapsed"); return true; }); $("#modify").parent().toggleClass("collapsed"); $(".trac-topnav a").click(function() { $("#modify").parent().removeClass("collapsed"); }); function setRevertHandler() { $("button.trac-revert").click(function() { var div = $("div", this); var field_name = div[0].id.substr(7); var field_value = div.text(); var input = $("#propertyform *[name=field_" + field_name + "]"); if (input.length > 0) { if (input.filter("input[type=radio]").length > 0) { input.val([field_value]); } else if (input.filter("input[type=checkbox]").length > 0) { input.val(field_value == "1" ? [field_value] : []); } else { input.val(field_value); } } else { // Special case for CC checkbox input = $("#propertyform input[name=cc_update]").val([]); } input.change(); // Remove the revert button if ($(this).closest("tbody").children("tr").length === 1) $(this).closest(".trac-change-panel").remove(); else $(this).closest("tr").remove(); return false; }); } setRevertHandler(); var comment_focused = false; $("#comment").focus(function() { comment_focused = true; }) .blur(function() { comment_focused = false; }); $("#propertyform").autoSubmit({preview: '1'}, function(data, reply) { var items = $(reply); // Update ticket box $("#ticket").replaceWith(items.filter('#ticket')); // Replaces content of #changelog, without recreating it $("#changelog").empty().append(items.filter("#changelog").contents()); // Apply comments order and "Show" preferences applyCommentsOrder( $('#prefs input[name="trac-comments-order"]:checked').val()); // Show warning var new_changes = $("#changelog .trac-new"); $("#trac-edit-warning").toggle(new_changes.length != 0); if (new_changes.length != 0) $("#changelog").parent().show().removeClass("collapsed"); // Update view time $("#propertyform input[name='view_time']").replaceWith(items.filter("input[name='view_time']")); // Update preview var preview = $("#ticketchange").html(items.filter('#preview').children()); var show_preview = preview.children().length != 0; $("#ticketchange").toggle(show_preview); setRevertHandler(); // Execute scripts to load stylesheets items.filter("script").appendTo("head"); }, "#ticketchange .trac-loading"); $("#trac-comment-editor").autoSubmit({preview_comment: '1'}, function(data, reply) { var comment = $("#trac-comment-editor").next("div.comment").html(reply); comment.toggle(comment.children().length != 0); }, "#changelog .trac-loading"); /*]]>*/ }); </script> </head> <body id="wordpress-org" class="bbpress trac wporg-make make-bbpress"> <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-P24PF4B" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript> <dl id="accessibility"> <dt>Skip to:</dt> <dd><a href="#content" title="Skip to content">Content</a></dd> </dl> <div id="wporg-header"> <div id="header-inner"> <button id="mobile-menu-button" aria-expanded="false"><span class="screen-reader-text">Toggle Menu</span></button> <ul id="wporg-header-menu"> <li><a href="https://bbpress.org/about/">About</a></li> <li><a href="https://bbpress.org/plugins/">Plugins</a></li> <li><a href="https://bbpress.org/themes/">Themes</a></li> <li><a href="https://codex.bbpress.org/">Documentation</a></li> <li><a href="https://bbpress.org/blog/">Blog</a></li> <li><a href="https://bbpress.org/forums/">Support</a></li> <li class="download"><a href="https://bbpress.org/download/">Download</a></li> </ul> <h1><a href="https://bbpress.org">bbPress.org</a></h1> </div> </div> <div id="subnav"> <div id="subnav-inner"> <ul id="nav-user" class="menu"> <li class="last first"> <a href="https://login.wordpress.org/?redirect_to=https%3A%2F%2Fbbpress.trac.wordpress.org%2Fticket%2F2366" class="login">Login</a></li> </ul> </div> </div> <div id="banner"> <form id="search" action="/search" method="get"> <div> <label for="proj-search">Search:</label> <input type="text" id="proj-search" name="q" size="18" value="" /> <input type="submit" value="Search" /> </div> </form> </div> <div id="mainnav" class="nav"> <ul> <li class="first"><a href="/timeline">Timeline</a></li><li class="active"><a href="/report">View Tickets</a></li><li><a href="/roadmap">Roadmap</a></li><li><a href="/browser">Browse Source</a></li><li class="last"><a href="/ticketgraph">Ticket Graph</a></li> </ul> </div> <div id="main"> <div id="ctxtnav" class="nav"> <h2>Context Navigation</h2> <ul> <li class="first"><span>← <a class="prev" href="/ticket/2365" title="Ticket #2365">Previous Ticket</a></span></li><li class="last"><span><a class="next" href="/ticket/2367" title="Ticket #2367">Next Ticket</a> →</span></li> </ul> <hr /> </div> <div id="content" class="ticket"> <div id="ticket" class="trac-content "> <div class="date"> <p>Opened <a class="timeline" href="/timeline?from=2013-07-10T14%3A56%3A43Z&precision=second" title="See timeline at 07/10/2013 02:56:43 PM">11 years ago</a></p> <p>Closed <a class="timeline" href="/timeline?from=2013-07-10T15%3A01%3A09Z&precision=second" title="See timeline at 07/10/2013 03:01:09 PM">11 years ago</a></p> </div> <h2> <a href="/ticket/2366" class="trac-id">#2366</a> <span class="trac-status"> <a href="/query?status=closed">closed</a> </span> <span class="trac-type"> <a href="/query?status=!closed&type=defect+(bug)">defect (bug)</a> </span> <span class="trac-resolution"> (<a href="/query?status=closed&resolution=fixed">fixed</a>) </span> </h2> <h1 id="trac-ticket-title" class="searchable"> <span class="summary">Sticky escalation for non-moderators</span> </h1> <table class="properties"> <tr> <th id="h_reporter">Reported by:</th> <td headers="h_reporter" class="searchable"> <a href="https://profiles.wordpress.org/johnjamesjacoby" data-nicename="johnjamesjacoby"> <img class="avatar" src="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=48" srcset="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=96 2x" height="48" width="48" alt="johnjamesjacoby's profile" /> </a> <a class="trac-author" href="/query?status=!closed&reporter=johnjamesjacoby">johnjamesjacoby</a></td> <th id="h_owner">Owned by:</th> <td headers="h_owner"> <a href="https://profiles.wordpress.org/johnjamesjacoby"> <img class="avatar" src="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=48" srcset="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=96 2x" height="48" width="48" alt="johnjamesjacoby's profile" /> </a> <a class="trac-author" href="/query?status=!closed&owner=johnjamesjacoby">johnjamesjacoby</a></td> </tr> <tr> <th id="h_milestone"> Milestone: </th> <td headers="h_milestone"> <a class="closed milestone" href="/milestone/2.4" title="Completed 11 years ago (08/24/2013 02:38:47 PM)">2.4</a> </td> <th id="h_priority"> Priority: </th> <td headers="h_priority"> <a href="/query?status=!closed&priority=normal">normal</a> </td> </tr><tr> <th id="h_severity"> Severity: </th> <td headers="h_severity"> <a href="/query?status=!closed&severity=major">major</a> </td> <th id="h_version"> Version: </th> <td headers="h_version"> <a href="/query?status=!closed&version=2.1">2.1</a> </td> </tr><tr> <th id="h_component"> Component: </th> <td headers="h_component"> <a href="/query?status=!closed&component=Component+-+Topics">Component - Topics</a> </td> <th id="h_keywords"> Keywords: </th> <td headers="h_keywords" class="searchable"> <a href="/query?status=!closed&keywords=~has-patch">has-patch</a> </td> </tr><tr> <th id="h_cc" class="missing"> Cc: </th> <td headers="h_cc" class="searchable"> </td> <th class="missing"> </th> <td> </td> </tr> </table> <div class="description"> <h3 id="comment:description"> Description </h3> <div class="searchable"> <p>Non-moderators are able to escalate the sticky-status of a new topic by spoofing the 'bbp_stick_topic' $_POST parameter, as the _new_ and _edit_ handlers are missing a 'moderator' capability check.<br /></p><p>iirc, the long term plan was to use a dedicated 'stick_topics' capability, and map it to moderate (this is how bbPress 1.x handled this) though it seems overkill for core to map this, as a plugin would need to remap it to change the behavior anyways.<br /></p><p>Patch imminent, adds cap checks to the _new_ and _edit_ handlers.<br /></p> </div> </div></div> <div id="attachments"> <h3 class="foldable">Attachments <span class="trac-count">(1)</span></h3> <div class="attachments"> <dl class="attachments"> <dt> <a href="/attachment/ticket/2366/2336.patch" title="View attachment">2336.patch</a><a href="/raw-attachment/ticket/2366/2336.patch" class="trac-rawlink" title="Download"></a> (<span title="2225 bytes">2.2 KB</span>) - added by <span class="trac-author">johnjamesjacoby</span> <a class="timeline" href="/timeline?from=2013-07-10T14%3A57%3A23Z&precision=second" title="See timeline at 07/10/2013 02:57:23 PM">11 years ago</a>. </dt> </dl> <p> Download all attachments as: <a rel="nofollow" href="/zip-attachment/ticket/2366/">.zip</a> </p> </div> </div> <div> <div class="trac-noscript" style="position: relative"> <form id="prefs" method="get" action="/prefs" style="position: absolute; right: 0"> <div id="trac-comments-order"> <input type="radio" id="trac-comments-oldest" name="trac-comments-order" value="oldest" checked="checked" /> <label for="trac-comments-oldest">Oldest first</label> <input type="radio" id="trac-comments-newest" name="trac-comments-order" value="newest" /> <label for="trac-comments-newest">Newest first</label> <span id="trac-threaded-toggle" style="display: none"> <input type="radio" id="trac-comments-threaded" name="trac-comments-order" value="threaded" /> <label for="trac-comments-threaded">Threaded</label> </span> </div> <div> <input id="trac-show-comments-toggle" type="checkbox" checked="checked" /> <label for="trac-show-comments-toggle">Show comments</label> <input id="trac-show-property-changes-toggle" type="checkbox" /> <label for="trac-show-property-changes-toggle">Show property changes</label> </div> </form> </div> <h3 class="foldable">Change History <span class="trac-count">(2)</span></h3> <div id="changelog"> <div class="change"> <h3 class="change"> <span class="threading"> </span> <span class="avatar"> <span class="username-line"><a href="https://profiles.wordpress.org/johnjamesjacoby" class="profile-link"> <img src="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=48" srcset="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=96 2x" height="48" width="48" alt="" /> @<span class="username" data-username="johnjamesjacoby" data-nicename="johnjamesjacoby"><span class="trac-author">johnjamesjacoby</span></span></a></span> <br /><span class="time-ago"><a class="timeline" href="/timeline?from=2013-07-10T14%3A57%3A23Z&precision=second" title="See timeline at 07/10/2013 02:57:23 PM">11 years</a> ago</span> </span> <div class="trac-ticket-buttons"> </div> </h3> <div class="trac-ticket-buttons"></div> <ul class="changes"> <li class="trac-field-attachment"> <strong class="trac-field-attachment">Attachment</strong> <a href="/attachment/ticket/2366/2336.patch"><em>2336.patch</em></a><a href="/raw-attachment/ticket/2366/2336.patch" title="Download" class="trac-rawlink"></a> added </li> </ul> </div> <div class="change" id="trac-change-1-1373468469749559"> <h3 class="change"> <span class="threading"> <span id="comment:1" class="cnum"> <a href="#comment:1">#1</a> </span> </span> <span class="avatar"> <span class="username-line"><a href="https://profiles.wordpress.org/johnjamesjacoby" class="profile-link"> <img src="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=48" srcset="https://wordpress.org/grav-redirect.php?user=johnjamesjacoby&s=96 2x" height="48" width="48" alt="" /> @<span class="username" data-username="johnjamesjacoby" data-nicename="johnjamesjacoby"><span class="trac-author">johnjamesjacoby</span></span></a></span> <br /><span class="time-ago"><a class="timeline" href="/timeline?from=2013-07-10T15%3A01%3A09Z&precision=second" title="See timeline at 07/10/2013 03:01:09 PM">11 years</a> ago</span> </span> <div class="trac-ticket-buttons"> </div> </h3> <div class="trac-ticket-buttons"></div> <ul class="changes"> <li class="trac-field-owner"> <strong class="trac-field-owner">Owner</strong> set to <em>johnjamesjacoby</em> </li><li class="trac-field-resolution"> <strong class="trac-field-resolution">Resolution</strong> set to <em>fixed</em> </li><li class="trac-field-status"> <strong class="trac-field-status">Status</strong> changed from <em>new</em> to <em>closed</em> </li> </ul> <div class="comment searchable"> <p>In <a class="changeset" href="/changeset/5019" title="In bbp_new_topic_handler() and bbp_edit_topic_handler(), restrict ...">5019</a>:<br /></p><div class="message"><p>In bbp_new_topic_handler() and bbp_edit_topic_handler(), restrict sticky topic actions to users with 'moderate' capability. Fixes <a class="closed ticket" href="/ticket/2366" title="#2366: defect (bug): Sticky escalation for non-moderators (closed: fixed)">#2366</a>.<br /></p></div> </div> </div> </div> </div> <div id="help"><strong>Note:</strong> See <a href="/wiki/TracTickets">TracTickets</a> for help on using tickets.</div> </div> <div id="altlinks"> <a class="preferences-link" href="/prefs">Trac UI Preferences</a> <h3>Download in other formats:</h3> <ul> <li class="first"> <a rel="nofollow" href="/ticket/2366?format=csv" class="csv">Comma-delimited Text</a> </li><li> <a rel="nofollow" href="/ticket/2366?format=tab" class="tab">Tab-delimited Text</a> </li><li class="last"> <a rel="nofollow" href="/ticket/2366?format=rss" class="rss">RSS Feed</a> </li> </ul></div> </div> <div id="footer"> <div class="links"> <p> See also: <a href="http://wordpress.org">WordPress.org</a> • <a href="http://bbpress.org">bbPress.org</a> • <a href="http://buddypress.org">BuddyPress.org</a> • <a href="http://ma.tt">Matt</a> • <a href="http://bbpress.org/feed/" title="RSS Feed for Articles">Blog RSS</a> </p> </div> <div class="details"> <p> <a href="http://twitter.com/bbpress" class="twitter">Follow bbPress on Twitter</a> • <a href="http://bbpress.org/about/gpl/">GPL</a> • <a href="http://bbpress.org/contact/">Contact Us</a> • <a href="http://bbpress.org/terms/">Terms of Service</a> </p> </div> </div> <script> var wpTracCurrentUser = "anonymous"; </script> <script src="https://s.w.org/style/js/navigation.min.js?20190128"></script> <script src="https://s.w.org/style/trac/jquery.caret.min.js?ver=2015-02-01"></script> <script src="https://s.w.org/style/trac/jquery.atwho.min.js?ver=1.0.1"></script> <script src="https://s.w.org/style/trac/wp-trac.js?220"></script> </body></html>
