[John James Jacoby]

bbPress 2.2 implements a new way to think about user roles in both WordPress and bbPress. A few users have posted up having issues after upgrading, so I’m going to take some time to explain what changed and why.

The problem bbPress 2.2 addresses, is the situation where a users ability to take certain actions in the forums was dictated by their role on the entire site, or their “blog role” as I’ll refer to it in some places going forward.

This means that in the past, a user could not be both a blog Editor and a forum Moderator at the same time; you’d need to be one or the other, and it was clear this wasn’t what anybody wanted.

In bbPress 2.0 and 2.1, every time you activated bbPress on a site, it went in and added a bunch of capabilities to the database. You never knew this, but it needed these roles so that users could perform certain tasks. bbPress would go in and modify the core WordPress roles, to add these capabilities to them. This made multisite installations a challenge, and network activation was very difficult too, because these roles needed to be added to every single site.

For existing users of sites, bbPress performed a bunch of calculations and educated guesses to automatically grant users with certain roles and capabilities. To do this, it would eventually need to add capabilities to the user, or switch them to a role that had those capabilities already; Forum Participant.

Subsequent updates to bbPress required database migration scripts for every change to user roles and capabilities. This is a lot of work for very little gain, since we’re not solving any problems with users needing multiple roles, and at the same time we’re polluting the database with a bunch of data that doesn’t change 99% of the time.

—

Under the hood, WordPress comes with support for users having multiple roles, and this is a perfect use-case for needing that functionality. Roles are just groups of capabilities. If a user has a role, it’s safe to assume they also have certain capabilities, right?

Wrong. Kind of. Sometimes.

Capabilities are saved in the database, per user, per site, and they bubble based on the role they are granted. If you use any plugin that modifies editable roles or capabilities in the database, what you’re doing is changing the individual capabilities for every user that gets that role going forward, but not necessarily every user that had that role in the past.

Remember, individual users have individual capabilities. When a user gets a new role that is modified in some way, they also get assigned the changed capabilities, either positive or negative. Negative capabilities are explicitly negative, and neither WordPress nor bbPress use these in core. They’re tricky, and make it easy to break things.

Once you’ve gone this far in, you’re playing with fire and will likely get burned. You now have altered core user roles, extra forum user roles, and a mish-mash of registered users with a random assortment of capabilities, based on when they signed up, what role they were granted, and what you happened to have changed that blog role’s capabilities to be at that moment.

To top this all off, there is no “repair” for your users, they’re basically stuck.

For bbPress users that never modified user roles or capabilities, their update process would be smooth sailing. It’s the modifications to database permissions that cause issues with bbPress 2.2. Why?

bbPress 2.2 introduces the concept of “dynamic roles” VS WordPress’s “editable roles.” What’s the difference? Editable roles are saved in the database, and allow you to completely shoot yourself in the foot (as above) once you start changing them around. Dynamic roles do not touch the database in any way, other than to assign the 1 role to the user, side-by-side with any other role they might have on your site.

bbPress comes with filters to allow you to modify the roles, and it’s still possible to add or subtract specific forum capabilities to a user if you needed to, and without all the fuss and danger of bbPress interfering with existing user roles and capabilities.

For users that are stuck with users that can’t access the forums, try using the forums role repair tool, located in: Admin > Tools > Forums

That tool loops through your users, and grants them a forum role based on their blog role based on the following map:

Admin = Keymaster
Editor = Participant
Author = Participant
Contributor = Participant
Subscriber = Participant

The map can be filtered, as can the default role of Participant. The problem will come in with existing users that have modified Participant roles that you may have tinkered with. They’ll end up with capabilities that are totally out of whack, no matter what you do. You’ll need to use an additional tool on top of this, if you want to clean up those old roles introduced by plugins like S2member.

Going forward, I’d like to get a better idea on what these plugins are doing, and make sure that bbPress plays as nicely as it can with them. Dynamic roles in WordPress core are probably a few releases away, but it’s important to bbPress’s future to have them in and working as soon as possible, to get everything dialed in for everyone.

[NickMackz]

Thank you for taking the time to fully explain what the system was like before and what has changed. Now I have a reasonable understanding of how the old and new systems work, I should be able to progress with fixing the problems I’ve got due to using completely custom roles.

Thanks for all the time and effort you put into bbPress and BuddyPress. They are great plugins and you do a great job. 🙂

[andymacleod]

Thanks for the explanation. I think this is definitely the right step forward!

The next step forward? If bbpress could add/delete and edit existing forum roles without the need for a third-party plugin.

Thanks,

Andy

[fuzzybee]

Thank you, John!

[John James Jacoby]

bbPress 2.2.1 takes another step towards automating this for installations with custom roles. If you have custom roles, bbPress will now fallback to the default role for those users.

[markkelly1982]

Hey John,

I’m having the following issue:

Participants cannot create topics or reply to topics on forums that have been created through the ‘Groups’ section.

They can create topics or reply to topics on forums that have been created direct though the forums section.

On the forums that have been created through the ‘Groups’ section it returns the following:

ERROR: You do not have permission to reply.

Any suggestions?

Thanks,

Mark

[markkelly1982]

I’ve narrowed the above problem down a bit more:

The ‘Participant’ who created the forum though the group cannot post topics. Everyone else can post to it.

[markkelly1982]

anyone having the same issue as me? Participants who create forums thru the group can’t post to their own forum. I’ve played around with the roles and it’s only happening to the ‘participant’ role.. appreciate any help..

[Kevin Behrens]

Capabilities are saved in the database, per user, per site, and they bubble based on the role they are granted. If you use any plugin that modifies editable roles or capabilities in the database, what you’re doing is changing the individual capabilities for every user that gets that role going forward, but not necessarily every user that had that role in the past.

I think the type-specific dynamic roles are a nice addition to the WP permissions layer. No doubt a significant minority of users will continue to find value and convenience in the ability to customize stored role definitions. Once WP moves to disregard the wp_user_roles array, role editing plugins will just be forced to store the rolecaps array externally and apply them through the filters you provide.

I won’t argue the philosophy of how much customization to fence off for safety/liability, but your writeup exaggerates some of the existing hazards. The “existing users unaffected by role edit” scenario only occurs if custom user capabilities were explicitly assigned. Otherwise, under stock code:

Granting a role stores the role name into the user’s usermeta capabilities array. So editing a stored role definition does affect current members of that role (not just future members).

Granting a role does not store a copy of all currently defined rolecaps into the usermeta capabilities array.

[John James Jacoby]

That’s true. Unfortunately before bbPress 2.2, users had to go digging to assign forum moderator capabilities to users with existing WordPress roles, so we indirectly drove users towards that solution already. :/

[stanis]

I can not change the user capabilities with plugins Members or User Role Editor

The following message appears:
Fatal error: Call to a member function has_cap ()

Is there any solution?

Thanks

[NickMackz]

Just tried updating to bbPress 2.2.2 on my site that has completely custom roles. All of my roles capabilities were left mostly unchanged but had all their bbPress capabilities removed. For some reason, the role I had called ‘Member’ got completely deleted and all users who had that role now display as having ‘none’ as their role. In the wp_usermeta table, users still have ‘member’ set as their role, but the role no longer exists in wp_user_roles in wp_options.

The forum roles appear to have been created correctly but all of my users (including Administrators) have no forum role at the moment. Strangely, Administrators still have complete control over the forums despite having no forum role or capabilities. I suppose this is because the Administrator role automatically has all capabilities?

What could have caused my Member role to be deleted? Is it safe for me to just copy it back into wp_user_roles in wp_options from the backup I have of the database? How can I assign all current users a forum role?

Thanks in advance 🙂

[NickMackz]

Well that’s weird. The ‘Member’ role just recreated itself. All I did was tick ‘Allow BuddyPress Groups to have their own forums’ in the forum options and save-changes and ‘Repair BuddyPress Group Forum relationships’ in tools.

It doesn’t have the same capabilities that it had before. It has gained the edit-posts capability and has a few bbPress related capabilities.

[John James Jacoby]

“Member” is a role created by BuddyPress when activating the old forums component. It’s possible it got wiped out during an activation or update process.

[livninctry]

I have read through everything I can find about user roles and have the latest updates installed and am still having so many problems even after trying several different role plugins. The only way it seems I can let users post new topics is to give them moderator status…. I have tried adding user roles using members and URE and nothing changes. Any help would be greatly appreciated.

[livninctry]

As a follow up to my post above… I tried a completely fresh install of wordpress, switched to the suffusion theme, added bbpress and added the suffusion bbpress pack.
The admin has complete control. Added a forum and a topic to test settings.
Added new user with a role of contributor for the system and participant for forum role.
Logged into the website as the new user and noticed that the only action allowed would be to create a new post. Should this user not be allowed to post new topics?
I am completely at a loss as to what I am overlooking.

original site:
http://dev.hoaconnections.com/venturahoa/

fresh install:
http://dev.hoaconnections.com/ventura/

[Stephen Edgar]

@livninctry I see you are using some kind of custom registration form to register users on both sites, is this causing any roles or modifying user permissions?

For your ‘dev’ environment I would install WordPress and then bbPress and NOT installing the suffusion theme or the suffusion bbPress pack and see if everything works before adding anything else.

Kind of the same for your main site, disable ALL plugins except bbPress and check to make sure everything works, then try with the suffusion theme, check everything again, then the suffusion bbPress pack, check everything again, then each of your other plugins one by one checking everything each and everytime.

I also see that the Suffusion bbPress pack v1.01 has not been updated in a while “Last Updated: 2012-7-25” or has it been updated since reported problems 2 months ago https://wordpress.org/support/topic/plugin-suffusion-bbpress-pack-compatibility-issues-with-latest-bbpress-212

[livninctry]

Ok going to bed… The plugin works fine… What was throwing me off was that when you scrolled the new button on the top navigation bar the option to add new topic was not there. You actually had to click on the forum and then post new topic. Sorry for the confusion….

[anthony.laquerre]

Hi, we have a problem and we are not sure how we can fix it.
Since we are on BBPress 2.2.2, BBPress dont display the “initial” message from every thread.
Example :
Subject 1 – Body 1 ( initial message)
Subject 1 – Body 2 ( answer to)

The ONLY role that is able to see all message is Administrator.
All others will always see only the answer and never the question…
We try pretty much all kind of combinaison…

This is really huge for us because since the move to 2.2.2, nobody can really read new subjects.

Can you tell us how to fix this ?
Thanks!
Anthony

[Justin Tadlock]

While I certainly understand WordPress’ failings in the user/role/cap department, this update to bbPress has caused a major issue. See, for folks who have been using role-editing plugins (such as my Members plugin), they’re now getting errors because of “dynamic roles”.

This update messes up other plugins that work with the system WordPress has in place (editable roles). Now, I’m stuck with support questions, emails, and forum posts asking why my plugin is broken when bbPress introduced this problem. This is a major issue that should probably be resolved soonish because many of the users of my Members plugin are going to hit this issue as they update their bbPress installs. The two plugins previously worked in perfect harmony. In fact, many bbPress users started using Members to have the level of control they needed for their forums.

Admittedly, I haven’t dug into the code yet. But, I’m guessing the problem with a role-editing plugin and bbPress is that the bbPress roles cannot be edited, which was standard functionality before. Since bbPress is modifying the overall [editable] roles array, there’s no way for my plugin to separate the two sets of roles (editable, WordPress-style roles vs. dynamic, bbPress-style roles).

Obviously, I could write some bbPress-specific code in my plugin to overcome this issue, but why should I? That means I’d have to keep up with bbPress role updates to make sure I stay in line with this new system. Plus, this sets precedence for other plugins to use this same, dynamic roles system.

I think bbPress should stick to doing what it does best: being an awesome forum plugin. Leave the role/cap stuff to plugins meant to handle this sort of thing. At the very least, it would’ve been nice to give a heads up to plugin authors who maintain role-editing plugins.

I’m not against the ideas presented with dynamic roles (I’m actually intrigued by it), but let’s wait for WordPress to catch up if this is the direction it’ll eventually go in.

I’ll definitely be looking into the issue further, but I’ve got a busy schedule at the moment.

[Justin Tadlock]

I actually have some ideas about fixing this after reading through your WP Ticket #22361. I’m pretty sure I have a good solution that I can implement on my end anyway.

[Justin Tadlock]

Sorry to be taking over this topic. I had just directed everyone with Members/bbPress issues here to follow along with any developments.

It was much easier to simply look at the code than to read the explanation, but I figured out the issue and just pushed an update for Members plugin users live. So, JJJ, if you run into any questions from my users about this, tell them to update Members to version 0.2.2+.

If nothing else, I got a lot of useful ideas. 🙂

[LabSecrets]

Justin,

Kudos for the quick update! We’ve found the Members plugin to be an indispensable tool when used in combination with bbPress and even BuddyPress / WooCommerce (subscriptions). Previously we used the role management to make subscription sites possible with members-only support forums.

After reading your post, and on the suggestion of JJJ, we updated our step by step guide to configuring bbPress 2.2.2 & BuddyPress 1.6.1, and included a special reference to using the Members plugin to solve those situations where one needs a “special” mix of the roles and capabilities between WP and bbP.

Have a peek if yo have the time:

The Definitive Guide To BuddyPress & bbPress Configuration

Direct link to video: http://labzip.com/the-definitive-guide-to-buddypress-bbpress-configuration/

Keep up the great work! 😉

Cheers!

spence

[Xarcell]

Why aren’t the topic tags, synced with blog tags? Or have a topic tag cloud?

[John James Jacoby]

@greenshady – Thanks for chiming in. Your Members plugin has always been our go-to while we sorted out Role/Capability issues in bbPress core.

Since 2.0, getting them dialed in and playing nicely with WordPress and Multisite has been a challenge. Creating update scripts for new functionality has a tendency to leave things in a semi-broken state, with some sites behaving, others not so much, and leaving users of bbPress powered communities sometimes wondering why certain functionalities of their accounts don’t work anymore.

Also, why can’t a blog Editor also be a Forum moderator? These are problems that should be solved with multiple roles, not with mapped blanket ‘moderator’ super capabilities like we tried to do previously.

I can’t say that storing roles and capabilities in the database is the entire problem, but moving to a dynamic setup like we have now all but eliminates the issues we’ve had the past year or so.

I appreciate you investigating things and updating Members. I haven’t had a chance to check out the updated version, but I have about a million feature requests for it. 🙂

[Justin Tadlock]

@johnjamesjacoby

I’m guessing I’ve just had an entirely different perspective. Many of my users are bbPress users. I don’t think I’ve once had a question regarding an issue between Members and bbPress. They just worked and everyone was in Happy La-la Land. 🙂

I definitely agree that multiple roles is the way to go. I just wish WordPress would support this in the UI for users out of the box or at least make it easier for us to do it. I’m not sure I’m sold on un-editable roles because some people just want to edit the caps of the bbPress roles. Of course, I deal with a higher number of people who like to dig in and get dirty with their WordPress installs.

Oh, definitely send over your feature requests for bbPress. I’m hoping to push out a major update for it early 2013.

@labsecrets

Cool. I’ll have to check it out.