Ticket #5319: ajax.php.patch

ajax.php

@@ -638 +638 @@
         // Cast fid as an integer
         $friend_id = (int) $_POST['fid'];
 
+        // Prevent POST request from member to himself
+        if ( bp_loggedin_user_id() == $friend_id )
+                exit();
+        
         // Trying to cancel friendship
         if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {
                 check_ajax_referer( 'friends_remove_friend' );