Community Events User Event Deletion Not Working

[Adam Listek]

Hello,

I have found that the ability for a user to delete their own event in the Community Events plugin does not function. I have done the following for troubleshooting:

• Revert to 2017 Theme
• Disable all plugins except Tribe plugins (Events Calendar, Events Calendar Pro, Community Events
• Verified that the ability to “Remove Events” was checked underneath Events Calendar Settings -> Community Events
• Attempted with all role access levels up to Administrator
• Attempted with a draft event and a published event

Please note that this is using the “/events/community/list/” view on the front-end.

I tracked down the code where this operation is occurring in the “/src/Tribe/Main.php” file of the Community Events plugin. On line 1517 under the “doDelete” function, it attempts to do a meta-capability check and a nonce verify. Removing the nonce verify does allow the event to be removed. The meta-capability check is functioning correctly.

Due to the fact that the delete button does show, the capability check is working (since the $canDelete variable in the view is set to true).

In addition, I do see that the _wpnonce is being passed via a GET parameter in the URL and that the actions match in the code (tribe_community_events_delete). I then logged the nonce URL being created for the view and the $_GET where “_wpnonce” is being read from and found that in the doDelete function $_GET is empty. It appears that the function cannot read that variable, or by the time it is being called the $_GET variable is set to empty.

Please advise as to the next steps, I can do further debugging to find the fix for this or if there is something wrong in my methodology or setup, I would appreciate your expertise. Thank you!

-Adam Listek

[Andras]

Hello Adam,

Thanks for getting in touch and reporting this in such detail.

I have tried to reproduce this on my local install and didn’t have any issues deleting.

I tried it with a subscriber level user, with event status as ‘pending review’ and ‘published’ as well.

Would it be possible for you to test this on a clean install with only the calendar plugins?

Thanks,
Andras

 

[Adam Listek]

Hello,

Thank you for looking into this. I did a completely fresh WordPress 4.8 install with only the three plugins installed using the 2017 theme. I used the latest versions of all the plugins.

I made a subscriber and set the ability for them to edit/remove events. I then signed in using incognito mode and created an event that I then tried to delete. I receive the same error, that “You do not have permission to delete this event.”

I run a NGINX (1.13.0), PHP-FPM (7.0.16), MariaDB (10.x) stack on a 16.04 Ubuntu server. It should be a fairly standard stack, also since this is a development server, all caching is turned off (I use NGINX Microcache and Redis for Object Caching on my production server). The site is behind CloudFlare with strict SSL on.

If you want, I am more than happy to grant access to the test site for further troubleshooting. I am going to work on further debugging to see if it is something in my server configuration or something else. Thank you!

-Adam

[Andras]

Thanks Adam,

I ran another test on a different site, same results. All went well with a subscriber, with Chrome, incognito mode.

No clue what could be the case here, so I’m going to ask another set of eyes to take a look at this.

Meanwhile if you find something, please let us know.

Cheers,
Andras

 

[Adam Listek]

Andras,

I had posted a follow-up awhile ago as I figured out the problem, but for some reason it disappeared. I’m assuming something with my browser so I apologize for not getting back to you sooner.

After much troubleshooting, I found that I needed to change my NGINX config to pass the query string (?$query_string). Up to this point, this has worked on every site and plugin because WordPress can read the “request_uri” and does not need the “query_string” to be passed. In this case The Events Calendar apparently does. Once that was passed in, deleting events worked properly.

try_files $uri $uri/ /index.php?$query_string;

I have been unable to find better guidance on the usage of this in this directive (whether good or bad), so until that point, for functionalities sake, I am going to continue using this.

Thank you for your help and hopefully this assists others!

-Adam

[Andras]

Hi Adam,

Thanks for reporting back on that.

Good job on finding a solution for the issue! Awesome!

Since this is marked resolved I am going to close this ticket, but if you need anything else related to this topic or another please post a new one in the forum and we will be happy to help you out.

Cheers,
Andras

PS: If you like our plugins, and you didn’t yet do so 🙂 we would be happy to receive a review in the wordpress.org repository. Thanks!
https://wordpress.org/support/plugin/the-events-calendar/reviews/

PS2: We’d be also grateful if you would give us feedback on your satisfaction with support. Just click on one of the classy looking emojis below. 🙂 If you can spare a few words, that’s even better. Doublethanks!

 

 

[Author]

Posts