Ticket #7683: 7683-ajax.diff

src/bp-templates/bp-legacy/buddypress-functions.php

@@ -1395 +1395 @@
         // Cast fid as an integer.
         $friend_id = (int) $_POST['fid'];
 
+        $user = get_user_by( 'id', $friend_id );
+        if ( ! $user ) {
+                die( __( 'Not a valid user.', 'buddypress' ) );
+        }
+
         // Trying to cancel friendship.
         if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {
                 check_ajax_referer( 'friends_remove_friend' );

src/bp-templates/bp-nouveau/includes/friends/ajax.php

@@ -88 +88 @@
         // Cast fid as an integer.
         $friend_id = (int) $_POST['item_id'];
 
+        $user = get_user_by( 'id', $friend_id );
+        if ( ! $user ) {
+                wp_send_json_error(
+                        array(
+                                'feedback' => sprintf(
+                                        '<div class="bp-feedback error">%s</div>',
+                                        esc_html__( 'Not a valid user.', 'buddypress' )
+                                ),
+                        )
+                );
+        }
+
         // In the 2 first cases the $friend_id is a friendship id.
         if ( ! empty( $_POST['action'] ) && 'friends_accept_friendship' === $_POST['action'] ) {
                 if ( ! friends_accept_friendship( $friend_id ) ) {