Ticket #7684: 7684-1.diff

src/bp-core/bp-core-attachments.php

@@ -1189 +1189 @@
  *                     error message otherwise.
  */
 function bp_attachments_cover_image_ajax_upload() {
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_die();
         }
 
@@ -1378 +1378 @@
  *                     error message otherwise.
  */
 function bp_attachments_cover_image_ajax_delete() {
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error();
         }
 

src/bp-core/bp-core-avatars.php

@@ -809 +809 @@
  *                     error message otherwise.
  */
 function bp_avatar_ajax_delete() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error();
         }
 
@@ -952 +951 @@
  *                     error message otherwise.
  */
 function bp_avatar_ajax_upload() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_die();
         }
 
@@ -1237 +1235 @@
  *                     error message otherwise.
  */
 function bp_avatar_ajax_set() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error();
         }
 

src/bp-settings/bp-settings-actions.php

@@ -27 +27 @@
  * @global BuddyPress $bp
  */
 function bp_settings_action_general() {
-
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Bail if no submit action.
-        if ( ! isset( $_POST['submit'] ) )
+        if ( ! isset( $_POST['submit'] ) ) {
                 return;
+        }
 
         // Bail if not in settings.
-        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'general' ) )
+        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'general' ) ) {
                 return;
+        }
 
         // 404 if there are any additional action variables attached
         if ( bp_action_variables() ) {
@@ -259 +260 @@
  * @since 1.6.0
  */
 function bp_settings_action_notifications() {
-
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Bail if no submit action.
-        if ( ! isset( $_POST['submit'] ) )
+        if ( ! isset( $_POST['submit'] ) ) {
                 return;
+        }
 
         // Bail if not in settings.
-        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'notifications' ) )
+        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'notifications' ) ) {
                 return false;
+        }
 
         // 404 if there are any additional action variables attached
         if ( bp_action_variables() ) {
@@ -306 +308 @@
  * @since 1.6.0
  */
 function bp_settings_action_capabilities() {
-
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Bail if no submit action.
-        if ( ! isset( $_POST['capabilities-submit'] ) )
+        if ( ! isset( $_POST['capabilities-submit'] ) ) {
                 return;
+        }
 
         // Bail if not in settings.
-        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'capabilities' ) )
+        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'capabilities' ) ) {
                 return false;
+        }
 
         // 404 if there are any additional action variables attached
         if ( bp_action_variables() ) {
@@ -380 +383 @@
  * @since 1.6.0
  */
 function bp_settings_action_delete_account() {
-
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Bail if no submit action.
-        if ( ! isset( $_POST['delete-account-understand'] ) )
+        if ( ! isset( $_POST['delete-account-understand'] ) ) {
                 return;
+        }
 
         // Bail if not in settings.
-        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'delete-account' ) )
+        if ( ! bp_is_settings_component() || ! bp_is_current_action( 'delete-account' ) ) {
                 return false;
+        }
 
         // 404 if there are any additional action variables attached
         if ( bp_action_variables() ) {

src/bp-templates/bp-legacy/buddypress-functions.php

@@ -779 +779 @@
  * @return string|null Prints template loop for the specified object
  */
 function bp_legacy_theme_object_template_loader() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Bail if no object passed.
-        if ( empty( $_POST['object'] ) )
+        if ( empty( $_POST['object'] ) ) {
                 return;
+        }
 
         // Sanitize the object.
         $object = sanitize_title( $_POST['object'] );
 
         // Bail if object is not an active component to prevent arbitrary file inclusion.
-        if ( ! bp_is_active( $object ) )
+        if ( ! bp_is_active( $object ) ) {
                 return;
+        }
 
         /**
          * AJAX requests happen too early to be seen by bp_update_is_directory()
@@ -859 +861 @@
  *                     for the Activity component) and 'feed_url' (URL to the relevant RSS feed).
  */
 function bp_legacy_theme_activity_template_loader() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         $scope = '';
         if ( ! empty( $_POST['scope'] ) )
@@ -920 +922 @@
 function bp_legacy_theme_post_update() {
         $bp = buddypress();
 
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Check the nonce.
         check_admin_referer( 'post_update', '_wpnonce_post_update' );
@@ -1009 +1011 @@
 
         $bp = buddypress();
 
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 return;
         }
 
@@ -1078 +1079 @@
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_delete_activity() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Check the nonce.
         check_admin_referer( 'bp_activity_delete_link' );
@@ -1116 +1117 @@
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_delete_activity_comment() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Check the nonce.
         check_admin_referer( 'bp_activity_delete_link' );
@@ -1158 +1159 @@
 function bp_legacy_theme_spam_activity() {
         $bp = buddypress();
 
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Check that user is logged in, Activity Streams are enabled, and Akismet is present.
         if ( ! is_user_logged_in() || ! bp_is_active( 'activity' ) || empty( $bp->activity->akismet ) )
@@ -1203 +1204 @@
  */
 function bp_legacy_theme_mark_activity_favorite() {
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         if ( ! isset( $_POST['nonce'] ) ) {
                 return;
@@ -1232 +1234 @@
  * @return string|null HTML
  */
 function bp_legacy_theme_unmark_activity_favorite() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         if ( ! isset( $_POST['nonce'] ) ) {
                 return;
@@ -1263 +1265 @@
  * @return string|null HTML
  */
 function bp_legacy_theme_get_single_activity_content() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         $activity_array = bp_activity_get_specific( array(
                 'activity_ids'     => $_POST['activity_id'],
@@ -1303 +1305 @@
  * @todo Audit return types
  */
 function bp_legacy_theme_ajax_invite_user() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         check_ajax_referer( 'groups_invite_uninvite_user' );
 
@@ -1386 +1388 @@
  * @return string|null HTML
  */
 function bp_legacy_theme_ajax_addremove_friend() {
-
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Cast fid as an integer.
         $friend_id = (int) $_POST['fid'];
@@ -1440 +1441 @@
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_ajax_accept_friendship() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         check_admin_referer( 'friends_accept_friendship' );
 
@@ -1460 +1461 @@
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_ajax_reject_friendship() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         check_admin_referer( 'friends_reject_friendship' );
 
@@ -1480 +1481 @@
  * @return string|null HTML
  */
 function bp_legacy_theme_ajax_joinleave_group() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         // Cast gid as integer.
         $group_id = (int) $_POST['gid'];
@@ -1551 +1552 @@
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_ajax_close_notice() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         $nonce_check = isset( $_POST['nonce'] ) && wp_verify_nonce( wp_unslash( $_POST['nonce'] ), 'bp_messages_close_notice' );
 
@@ -1583 +1584 @@
  * @return string|null HTML
  */
 function bp_legacy_theme_ajax_messages_send_reply() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        if ( ! bp_is_post_request() ) {
                 return;
+        }
 
         check_ajax_referer( 'messages_send_message' );
 

src/bp-templates/bp-nouveau/includes/activity/ajax.php

@@ -33 +33 @@
  * @return string JSON reply
  */
 function bp_nouveau_ajax_mark_activity_favorite() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error();
         }
 
@@ -74 +73 @@
  * @return string JSON reply
  */
 function bp_nouveau_ajax_unmark_activity_favorite() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error();
         }
 
@@ -111 +109 @@
  * @return string JSON reply
  */
 function bp_nouveau_ajax_clear_new_mentions() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error();
         }
 
@@ -141 +138 @@
         );
 
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error( $response );
         }
 
@@ -213 +210 @@
         );
 
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error( $response );
         }
 
@@ -272 +269 @@
         );
 
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error( $response );
         }
 
@@ -497 +494 @@
         );
 
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error( $response );
         }
 

src/bp-templates/bp-nouveau/includes/ajax.php

@@ -15 +15 @@
  * @since 1.0.0
  */
 function bp_nouveau_ajax_object_template_loader() {
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error();
         }
 

src/bp-templates/bp-nouveau/includes/friends/ajax.php

@@ -35 +35 @@
         );
 
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 wp_send_json_error( $response );
         }
 

src/bp-templates/bp-nouveau/includes/groups/ajax.php

@@ -39 +39 @@
         );
 
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) || empty( $_POST['action'] ) ) {
+        if ( ! bp_is_post_request() || empty( $_POST['action'] ) ) {
                 wp_send_json_error( $response );
         }
 

src/bp-xprofile/bp-xprofile-actions.php

@@ -54 +54 @@
 function bp_xprofile_action_settings() {
 
         // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) ) {
+        if ( ! bp_is_post_request() ) {
                 return;
         }