Options, Settings Save, and AJAX

Options written by the plugin

All settings are stored with the BuddyPress option API (bp_get_option / bp_update_option). The five settings options are:

Option key	Written by tab
blpro_nl_settings	Visitor Restrictions
blpro_profile_visibility_settings	Profile Visibility
blpro_profile_progress	Profile Progress
blpro_membership_restrictions	Membership Restrictions
blpro_general_notices	Notice Messages

Other options used in code:

• blpro_update_2_4_0 - one-time upgrade flag that seeds default profile-progress messages.

User meta:

• blpro_profile_page_visibility - a member’s chosen profile visibility level.
• _has_complete_profile, _has_required_field_data, _has_avatar, _has_profile_cover - internal profile-completion tracking.

How settings are saved

Each settings tab renders its own <form method="post"> that posts one option array. A single handler on admin_init detects which option key was posted and persists it. The save is protected by:

• A shared nonce, action blpro_settings_save, field blpro_settings_nonce.
• A manage_options capability check.
• Recursive sanitization of the posted values at the boundary (rich fields such as the locked-content message and the custom form shortcode keep post-grade HTML; all other values are reduced to plain text).

Posted field names are historic and exact and must not be changed, because they define the saved option shape.

AJAX endpoints

Visitor login and registration (logged out)

Action	Hook	Notes
blpro_login	wp_ajax_nopriv_blpro_login	Signs a visitor in.
blpro_register	wp_ajax_nopriv_blpro_register	Creates and signs in a new user.

These are intentionally open to logged-out users (there is no capability to check for a visitor). They are protected by the nonce blpro_public_ajax_security, sent in the field ajaxNonce. The localized script object is blpro_public_obj.

Admin option-list endpoints (logged in)

Action	Hook	Purpose
blpro_gamipress_get_access_control_options	wp_ajax_blpro_gamipress_get_access_control_options	Returns GamiPress access-control options.
blpro_membership_get_access_control_options	wp_ajax_blpro_membership_get_access_control_options	Returns membership-plugin access-control options.

The admin script uses the nonce blpro_admin_ajax_security (localized as bppcAdmin).

Restriction enforcement on BuddyPress AJAX

The per-role group, friendship, and messaging limits are enforced by hooking BuddyPress’s own action nonspecific and specific AJAX actions (for example groups_join_group, friends_add_friend, messages_send_message, post_update). These run after BuddyPress core has already verified the action nonce, and only read the action name to decide which limit to apply.

Not present

The plugin does not register any REST API routes. All programmatic surfaces are the WordPress AJAX actions listed above, the shortcode, and the hooks in Hooks and filters.