Ticket #8004: 8004.1.diff

src/bp-core/bp-core-functions.php

@@ -3900 +3900 @@
 function bp_strip_script_and_style_tags( $string ) {
         return preg_replace( '@<(script|style)[^>]*?>.*?</\\1>@si', '', $string );
 }
+
+/**
+ * Produce WordPress nonces with the capability to specify the id of the input.
+ *
+ * @since 5.0
+ *
+ * @param int|string $action  Optional. Action name. Default -1.
+ * @param string     $id      Optional. Nonce input id. Default '_wpnonce'.
+ * @param string     $name    Optional. Nonce name. Default '_wpnonce'.
+ * @param bool       $referer Optional. Whether to set the referer field for validation. Default true.
+ * @param bool       $echo    Optional. Whether to display or return hidden form field. Default true.
+ * @return string Nonce field HTML markup.
+ */
+function bp_nonce_field( $action = -1, $id = "_wpnonce", $name = "_wpnonce", $referer = true , $echo = true ) {
+    $nonce_field = '<input type="hidden" id="' . esc_attr( $id ) . '" name="' . esc_attr( $name ) . '" value="' . wp_create_nonce( $action ) . '" />';
+
+    if ( $referer ) {
+        $nonce_field .= wp_referer_field( false );
+    }
+
+    if ( $echo ) {
+        echo $nonce_field;
+    }
+
+    return $nonce_field;
+}

src/bp-templates/bp-legacy/buddypress/activity/entry.php

@@ -140 +140 @@
                                          */
                                         do_action( 'bp_activity_entry_comments' ); ?>
 
-                                        <?php wp_nonce_field( 'new_activity_comment', '_wpnonce_new_activity_comment' ); ?>
+                                        <?php bp_nonce_field( 'new_activity_comment', '_wpnonce_new_activity_comment_' . bp_get_activity_id(), '_wpnonce_new_activity_comment' );?>
 
                                 </form>
 

src/bp-templates/bp-legacy/js/buddypress.js

@@ -610 +610 @@
                         ajaxdata = {
                                 action: 'new_activity_comment',
                                 'cookie': bp_get_cookies(),
-                                '_wpnonce_new_activity_comment': jq('#_wpnonce_new_activity_comment').val(),
+                                '_wpnonce_new_activity_comment': jq('#_wpnonce_new_activity_comment_' + form_id[2]).val() || jq('#_wpnonce_new_activity_comment').val(),
                                 'comment_id': comment_id,
                                 'form_id': form_id[2],
                                 'content': content.val()

src/bp-templates/bp-nouveau/buddypress/activity/comment-form.php

@@ -23 +23 @@
                 <input type="hidden" name="comment_form_id" value="<?php bp_activity_id(); ?>" />
 
                 <?php
-                bp_nouveau_submit_button( 'activity-new-comment' );
+                bp_nouveau_submit_button( 'activity-new-comment', bp_get_activity_id() );
                 printf(
                         '&nbsp; <button type="button" class="ac-reply-cancel">%s</button>',
                         esc_html( _x( 'Cancel', 'button', 'buddypress' ) )

src/bp-templates/bp-nouveau/includes/functions.php

@@ -1231 +1231 @@
  * @since 3.0.0
  *
  * @param string $action The action requested.
+ * @param string $id     An associated ID to use to customize the button. Optional.
  *
  * @return array|false The list of the submit button parameters for the requested action
  *                     False if no actions were found.
  */
-function bp_nouveau_get_submit_button( $action = '' ) {
+function bp_nouveau_get_submit_button( $action = '', $assoc_id = '' ) {
         if ( empty( $action ) ) {
                 return false;
         }
@@ -1337 +1338 @@
                         'after'     => 'bp_activity_entry_comments',
                         'nonce'     => 'new_activity_comment',
                         'nonce_key' => '_wpnonce_new_activity_comment',
+                        'nonce_id'  => ( $assoc_id ) ? "_wpnonce_new_activity_comment_{$assoc_id}" : '_wpnonce_new_activity_comment',
                         'wrapper'   => false,
                         'attributes' => array(
                                 'name'  => 'ac_form_submit',

src/bp-templates/bp-nouveau/includes/template-tags.php

@@ -2492 +2492 @@
  * @since 3.0.0
  *
  * @param string $action The action to get the submit button for. Required.
+ * @param string $id     An associated ID to use to customize the button. Optional.
  */
-function bp_nouveau_submit_button( $action ) {
-        $submit_data = bp_nouveau_get_submit_button( $action );
+function bp_nouveau_submit_button( $action, $assoc_id = '' ) {
+        $submit_data = bp_nouveau_get_submit_button( $action, $assoc_id );
         if ( empty( $submit_data['attributes'] ) || empty( $submit_data['nonce'] ) ) {
                 return;
         }
@@ -2524 +2525 @@
                 printf( '<div class="submit">%s</div>', $submit_input );
         }
 
-        if ( empty( $submit_data['nonce_key'] ) ) {
-                wp_nonce_field( $submit_data['nonce'] );
-        } else {
-                wp_nonce_field( $submit_data['nonce'], $submit_data['nonce_key'] );
-        }
+        $nonce_args = array(
+                'nonce'      => $submit_data['nonce'],
+                'nonce_id'   => ! empty( $submit_data['nonce_id'] ) ? $submit_data['nonce_id'] : '_wpnonce',
+                'nonce_name' => ! empty( $submit_data['nonce_key'] ) ? $submit_data['nonce_key'] : '_wpnonce'
+        );
+        bp_nonce_field( $nonce_args['nonce'], $nonce_args['nonce_id'], $nonce_args['nonce_name'] );
 
         if ( ! empty( $submit_data['after'] ) ) {
 

src/bp-templates/bp-nouveau/js/buddypress-activity.js

@@ -731 +731 @@
 
                                 comment_data = {
                                         action                        : 'new_activity_comment',
-                                        _wpnonce_new_activity_comment : $( '#_wpnonce_new_activity_comment' ).val(),
+                                        _wpnonce_new_activity_comment : $( '#_wpnonce_new_activity_comment_' + activity_id ).val() || $( '#_wpnonce_new_activity_comment' ).val(),
                                         comment_id                    : item_id,
                                         form_id                       : activity_id,
                                         content                       : comment_content.val()