Ticket #8544: 8544.patch

src/bp-messages/classes/class-bp-messages-message.php

@@ -129 +129 @@
                         return false;
                 }
 
-                $new_thread = false;
-
-                // If we have no thread_id then this is the first message of a new thread.
-                if ( empty( $this->thread_id ) ) {
-                        $this->thread_id = (int) $wpdb->get_var( "SELECT MAX(thread_id) FROM {$bp->messages->table_name_messages}" ) + 1;
-                        $new_thread      = true;
-                }
-
-                // First insert the message into the messages table.
-                if ( ! $wpdb->query( $wpdb->prepare( "INSERT INTO {$bp->messages->table_name_messages} ( thread_id, sender_id, subject, message, date_sent ) VALUES ( %d, %d, %s, %s, %s )", $this->thread_id, $this->sender_id, $this->subject, $this->message, $this->date_sent ) ) ) {
-                        return false;
-                }
-
-                $this->id = $wpdb->insert_id;
+        // If we have no thread_id then this is the first message of a new thread.
+        // Generate a new thread_id in the same transaction as the insert to avoid a race condition which could allow multiple threads to be assigned the same thread_id
+        if ( empty( $this->thread_id ) ) {
+            $new_thread = true;
+            $insert_message_query = $wpdb->prepare(
+                "INSERT INTO {$bp->messages->table_name_messages} "
+                . "( thread_id, sender_id, subject, message, date_sent ) "
+                . "VALUES ( "
+                . "( SELECT MAX(thread_id) FROM {$bp->messages->table_name_messages} m ) + 1, "
+                . "%d, %s, %s, %s )",
+                $this->sender_id, $this->subject, $this->message, $this->date_sent );
+        }
+        // Add a new message to an existing thread
+        else {
+            $new_thread = false;
+            $insert_message_query = $wpdb->prepare(
+                "INSERT INTO {$bp->messages->table_name_messages} "
+                . "( thread_id, sender_id, subject, message, date_sent ) "
+                . "VALUES ( %d, %d, %s, %s, %s )",
+                $this->thread_id, $this->sender_id, $this->subject, $this->message, $this->date_sent );
+        }
+
+        // First insert the message into the messages table.
+        if ( ! $wpdb->query( $insert_message_query ) ){
+            return false;
+        }
+
+        $this->id = $wpdb->insert_id;
+
+        // For new threads fetch the thread_id that was generated during the insert query
+        if ($new_thread) {
+            $this->thread_id = (int) $wpdb->get_var( $wpdb->prepare("SELECT thread_id FROM {$bp->messages->table_name_messages} WHERE id=%d", $this->id ) );
+        }
 
                 $recipient_ids = array();