Call returns different results on back end vs front re bbPress forums

[Jonathan]

Hi. I’m having an issue where PublishPress Permissions is causing the filter that decides whether a user can view a bbPress forum to return true, wrongly, when the check is run from the back-end. The call below returns true when it should be false when run from the back-end (as an admin user different from ID 18) and false when run as the user 18 on the front-end (expected). This is causing unexpected behavior in that non-forum members are receiving notifications of forum activity.

$user_id = 18;
$forum_id = 6663;
echo apply_filters( ‘bbp_user_can_view_forum’, $retval=true, $forum_id, $user_id );

Can you suggest a resolution?

[Kevin Behrens]

The plugin isn’t designed to hook into that bbPress filter. Try this instead:

• call wp_set_current_user(), passing user ID to test
• call bbp_user_can_view_forum() instead of applying the filter yourself
• call wp_set_current_user(), passing original user ID

[useStrict]

Hi @kevinb ,

Thanks for your response.

I’m the dev looking into this as it is conflicting with my premium addon bbpnns-learndash-bridge. Alas, your suggestion, albeit good, doesn’t fix the issue. I’ve managed to track this down further and discovered a potentially serious vulnerability.

Please contact me via email so I can explain it without exposing it publicly.

vinny [at] usestrict [dot] net

[Steve Burge]

Hi @usestrict

We have a guide here for reporting security issues: https://publishpress.com/knowledge-base/security-issues/

[useStrict]

Hi Steve, I’ve emailed your security address.

[Steve Burge]

Following up by email.