Respect hidden/private groups visibility in Cover endpoint

buddypress · Jan 16, 2024 · 0292fab · 0292fab
1 parent f6aeacc
commit 0292fab
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/includes/bp-groups/classes/class-bp-rest-attachments-group-cover-endpoint.php b/includes/bp-groups/classes/class-bp-rest-attachments-group-cover-endpoint.php
@@ -164,16 +164,17 @@ public function get_item_permissions_check( $request ) {
 		);
 
 		if ( bp_current_user_can( 'bp_view', array( 'bp_component' => 'groups' ) ) ) {
-			$retval      = new WP_Error(
+			$retval = new WP_Error(
 				'bp_rest_group_invalid_id',
 				__( 'Invalid group ID.', 'buddypress' ),
 				array(
 					'status' => 404,
 				)
 			);
+
 			$this->group = $this->groups_endpoint->get_group_object( $request );
 
-			if ( false !== $this->group ) {
+			if ( false !== $this->group && $this->groups_endpoint->can_see( $this->group ) ) {
 				$retval = true;
 			}
 		}

diff --git a/includes/bp-groups/classes/class-bp-rest-groups-endpoint.php b/includes/bp-groups/classes/class-bp-rest-groups-endpoint.php
@@ -1079,7 +1079,7 @@ protected function can_user_delete_or_update( $group ) {
 	 * @param  BP_Groups_Group $group Group object.
 	 * @return bool
 	 */
-	protected function can_see( $group ) {
+	public function can_see( $group ) {
 		// If it is not a hidden group, user can see it.
 		if ( 'hidden' !== $group->status ) {
 			return true;