BuddyPress.org

Hi @megainfo. I really appreciate all the work you’ve put into this much needed plugin! I found one easily rectifiable problem with the snippet of code in the bp_visibility_activity_filter() function you added for the re-inclusion of @mentions.

        // mentioned members can always see the acitivity whatever the privacy level
        if ( $visibility != 'mentionedonly' ){
            $usernames = bp_activity_find_mentions( $activity->content );
            $is_mentioned = array_key_exists( $bp_loggedin_user_id,  (array)$usernames );

            if( $is_mentioned )
                $remove_from_stream = false;
        }

When there are no @mentions in the content and $usernames returns blank, you cast $usernames as an array in order to keep array_key_exists from complaining. An unfortunate side effect of this turns out to be that (array)$usernames is an array with a single key-value pair of [0] -> ” and $bp_loggedin_user_id is 0 for a non-logged in user, thereby allowing a non-logged in user to see things they shouldn’t.

It took me a little while to figure all of this out, so please accept my patch as thanks for all your hard work!! I’ve modified my version of your code to the following:

        // mentioned members can always see the acitivity whatever the privacy level
        if ( $visibility != 'mentionedonly' && $remove_from_stream ){
			$is_mentioned = false;
            $usernames = bp_activity_find_mentions( $activity->content );
			if ( is_array($usernames) )
				$is_mentioned = array_key_exists( $bp_loggedin_user_id, $usernames );

            if( $is_mentioned )
                $remove_from_stream = false;
        }

I also added the && $remove_from_stream to the if statement, because there is no reason to run the additional code if the activity can already be seen.

I wonder if this is the reason @burakbirer says that Buddypress Activity Privacy 1.2.1 doesn’t work with BuddyPress 1.9.1? Everything else seems to work fine for me in that environment.

Many thanks,
Scott