diff --git a/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-directory-compat.php b/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-directory-compat.php
index 7599ba4c99..c97584986e 100644
--- a/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-directory-compat.php
+++ b/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-directory-compat.php
@@ -462,6 +462,13 @@ public function user_can_resolve( $retval, $user_id, $topic_id ) {
if ( ! $user ) {
return $retval;
}
+
+ // The compat object is loaded from the request, not from $topic_id.
+ $terms = get_the_terms( $topic_id, $this->taxonomy() );
+ if ( empty( $terms ) || is_wp_error( $terms ) || ! in_array( (string) $this->slug(), wp_list_pluck( $terms, 'slug' ), true ) ) {
+ return $retval;
+ }
+
if (
( ! empty( $this->authors ) && in_array( $user->user_nicename, $this->authors, true ) )
||
diff --git a/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-support-compat.php b/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-support-compat.php
index a650d71805..c32ac792c1 100644
--- a/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-support-compat.php
+++ b/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-support-compat.php
@@ -328,9 +328,9 @@ public function dropdown( $retval, $r ) {
* @return bool True if enabled, otherwise false
*/
public function is_enabled_on_forum( $retval, $forum_id = 0 ) {
- // Check the passed forum id.
+ // An explicit forum id wins over whatever the request happens to be rendering.
if ( ! empty( $forum_id ) ) {
- $retval = ( $forum_id != Plugin::REVIEWS_FORUM_ID );
+ return ( Plugin::REVIEWS_FORUM_ID !== (int) $forum_id );
}
// Check the current forum.
diff --git a/wordpress.org/public_html/wp-content/plugins/wporg-bbp-topic-resolution/inc/class-plugin.php b/wordpress.org/public_html/wp-content/plugins/wporg-bbp-topic-resolution/inc/class-plugin.php
index 52569ff8f0..0669994f09 100644
--- a/wordpress.org/public_html/wp-content/plugins/wporg-bbp-topic-resolution/inc/class-plugin.php
+++ b/wordpress.org/public_html/wp-content/plugins/wporg-bbp-topic-resolution/inc/class-plugin.php
@@ -264,10 +264,6 @@ public function get_topic_resolution_form() {
* @param string $action The requested action to compare this function to
*/
public function topic_resolution_handler( $action = '' ) {
- if ( ! $this->is_enabled_on_forum() ) {
- return false;
- }
-
// Bail if the action isn't meant for this function.
if ( $action != 'wporg_bbp_topic_resolution' ) {
return;
@@ -284,6 +280,11 @@ public function topic_resolution_handler( $action = '' ) {
$user_id = get_current_user_id();
$resolution = $_POST[ self::META_KEY ];
+ // Resolution must be enabled on the topic's forum, not on the one being viewed.
+ if ( $topic && ! $this->is_enabled_on_forum( bbp_get_topic_forum_id( $topic->ID ) ) ) {
+ return false;
+ }
+
// Check for empty topic id.
if ( empty( $topic_id ) || ! $topic ) {
bbp_add_error( 'wporg_bbp_topic_resolution_topic_id', __( 'Error: No topic was found!', 'wporg-forums' ) );
@@ -509,11 +510,9 @@ public function sanitize_topic_resolution( $resolution ) {
* @return bool True if allowed, false if not
*/
public function user_can_resolve( $user_id, $topic_id ) {
- $post = false;
- $topic_id = bbp_get_topic_id();
- if ( $topic_id ) {
- $post = get_post( $topic_id );
- }
+ // Authorize against the requested topic, only falling back to the displayed one.
+ $topic_id = bbp_get_topic_id( $topic_id );
+ $post = $topic_id ? bbp_get_topic( $topic_id ) : false;
if ( $user_id && $post && ( user_can( $user_id, 'moderate', $topic_id ) || $user_id == $post->post_author ) ) {
$retval = true;