Changeset 1032

Timestamp:

02/09/2009 06:52:51 AM (17 years ago)

Author:

apeatling

Message:

Added nonce security checks to all BuddyPress actions. Fixes #454

Location:

trunk

Files:

• bp-blogs.php (modified) (1 diff)
• bp-blogs/bp-blogs-templatetags.php (modified) (2 diffs)
• bp-blogs/js/directory-blogs.js (modified) (1 diff)
• bp-core.php (modified) (1 diff)
• bp-core/bp-core-avatars.php (modified) (1 diff)
• bp-core/bp-core-templatetags.php (modified) (1 diff)
• bp-core/js/directory-members.js (modified) (1 diff)
• bp-core/js/general.js (modified) (2 diffs)
• bp-forums.php (modified) (1 diff)
• bp-forums/bp-forums-filters.php (modified) (1 diff)
• bp-friends.php (modified) (5 diffs)
• bp-friends/bp-friends-ajax.php (modified) (2 diffs)
• bp-friends/bp-friends-templatetags.php (modified) (4 diffs)
• bp-friends/js/general.js (modified) (1 diff)
• bp-groups.php (modified) (30 diffs)
• bp-groups/bp-groups-ajax.php (modified) (8 diffs)
• bp-groups/bp-groups-classes.php (modified) (1 diff)
• bp-groups/bp-groups-templatetags.php (modified) (15 diffs)
• bp-groups/js/directory-groups.js (modified) (3 diffs)
• bp-groups/js/general.js (modified) (2 diffs)
• bp-messages.php (modified) (5 diffs)
• bp-messages/bp-messages-ajax.php (modified) (1 diff)
• bp-messages/bp-messages-templatetags.php (modified) (5 diffs)
• bp-messages/js/general.php (modified) (1 diff)
• bp-wire/bp-wire-templatetags.php (modified) (1 diff)
• bp-xprofile.php (modified) (7 diffs)

trunk/bp-blogs.php

@@ -110 +110 @@
     if ( is_site_admin() ) {
         /* Need to check db tables exist, activate hook no-worky in mu-plugins folder. */
-        if ( ( false == $wpdb->get_var("SHOW TABLES LIKE '%" . $bp->blogs->table_name . "%'") ) || ( get_site_option('bp-blogs-db-version') < BP_BLOGS_DB_VERSION )  )
+        if ( ( !$wpdb->get_var("SHOW TABLES LIKE '%" . $bp->blogs->table_name . "%'") ) || ( get_site_option('bp-blogs-db-version') < BP_BLOGS_DB_VERSION )  )
             bp_blogs_install();
     }

trunk/bp-blogs/bp-blogs-templatetags.php

@@ -692 +692 @@
                 <input id="submit" type="submit" name="submit" class="submit" value="<?php _e('Create Blog &raquo;', 'buddypress') ?>" />
             </p>
+            
+            <?php wp_nonce_field( 'bp_blog_signup_form' ) ?>
         </form>
         <?php
@@ -755 +757 @@
     global $wpdb, $current_user, $blogname, $blog_title, $errors, $domain, $path;
 
+    if ( !check_admin_referer( 'bp_blog_signup_form' ) ) 
+        return false;
+
     $current_user = wp_get_current_user();
     

trunk/bp-blogs/js/directory-blogs.js

@@ -6 +6 @@
             jQuery("div#blogs-list-options a").removeClass("selected");
             jQuery(this).addClass('selected');
+            jQuery("input#blogs_search").val('');
 
             var letter = jQuery(this).attr('id')

trunk/bp-core.php

@@ -240 +240 @@
     if ( is_site_admin() ) {
         /* Need to check db tables exist, activate hook no-worky in mu-plugins folder. */
-        if ( ( false == $wpdb->get_var( "SHOW TABLES LIKE '%{$bp->core->table_name_notifications}%'" ) ) || ( get_site_option('bp-core-db-version') < BP_CORE_DB_VERSION )  )
+        if ( ( !$wpdb->get_var( "SHOW TABLES LIKE '%{$bp->core->table_name_notifications}%'" ) ) || ( get_site_option('bp-core-db-version') < BP_CORE_DB_VERSION )  )
             bp_core_install();
     }

trunk/bp-core/bp-core-avatars.php

@@ -108 +108 @@
             echo '<span class="crop-img avatar">' . bp_core_get_avatar(get_current_user_id(), 1) . '</span>';
             echo '<span class="crop-img avatar">' . bp_core_get_avatar(get_current_user_id(), 2) . '</span>';
-            echo '<a href="' .  $delete_action . '">' . __( 'Delete', 'buddypress' ) . '</a>';
+            echo '<a href="' .  wp_nonce_url( $delete_action, 'bp_delete_avatar_link' ) . '">' . __( 'Delete', 'buddypress' ) . '</a>';
         }
 

trunk/bp-core/bp-core-templatetags.php

@@ -480 +480 @@
         
             <input type="submit" name="search-submit" id="search-submit" value="' . __( 'Search', 'buddypress' ) . '" />
+            ' . wp_nonce_field( 'bp_search_form' ) . '
         </form>
     ';

trunk/bp-core/js/directory-members.js

@@ -6 +6 @@
             jQuery("div#members-list-options a").removeClass("selected");
             jQuery(this).addClass('selected');
+            jQuery("input#members_search").val('');
             
             var letter = jQuery(this).attr('id')

trunk/bp-core/js/general.js

@@ -8 +8 @@
             fid = fid[1];
             
+            var nonce = jQuery(this).attr('href');
+            nonce = nonce.split('?_wpnonce=');
+            nonce = nonce[1].split('&');
+            nonce = nonce[0];
+
             var thelink = jQuery(this);
 
@@ -13 +18 @@
                 action: 'addremove_friend',
                 'cookie': encodeURIComponent(document.cookie),
-                'fid': fid
+                'fid': fid,
+                '_wpnonce': nonce
             },
             function(response)

trunk/bp-forums.php

@@ -159 +159 @@
 function bp_forums_new_post( $post_text = '', $topic_id = 0 ) {
     global $bbpress_live;
+
+    if ( !check_admin_referer( 'bp_forums_new_reply' ) ) 
+        return false;
     
     if ( !is_object( $bbpress_live ) ) {

trunk/bp-forums/bp-forums-filters.php

@@ -51 +51 @@
 function bp_forums_filter_decode( $content ) {
     $content = str_replace( '/amp/', '&', $content );
-    $content = html_entity_decode( $content, ENT_COMPAT, "UTF-8" );
+    $content = @html_entity_decode( $content, ENT_COMPAT, "UTF-8" );
     $content = str_replace( '[', '<', $content );
     $content = str_replace( ']', '>', $content );

trunk/bp-friends.php

@@ -73 +73 @@
     if ( is_site_admin() ) {
         /* Need to check db tables exist, activate hook no-worky in mu-plugins folder. */
-        if ( ( false == $wpdb->get_var( "SHOW TABLES LIKE '%{$bp->friends->table_name}%'") ) || ( get_site_option('bp-friends-db-version') < BP_FRIENDS_DB_VERSION )  )
+        if ( ( !$wpdb->get_var( "SHOW TABLES LIKE '%{$bp->friends->table_name}%'") ) || ( get_site_option('bp-friends-db-version') < BP_FRIENDS_DB_VERSION )  )
             friends_install();
     }
@@ -484 +484 @@
     global $bp;
     
+    /* Check the nonce */
+    if ( !check_admin_referer( 'friends_add_friend' ) ) 
+        return false;
+    
     $friendship = new BP_Friends_Friendship;
     
@@ -513 +517 @@
 function friends_remove_friend( $initiator_userid, $friend_userid ) {
     global $bp;
+
+    /* Check the nonce */
+    if ( !check_admin_referer( 'friends_remove_friend' ) ) 
+        return false;
         
     $friendship_id = BP_Friends_Friendship::get_friendship_id( $initiator_userid, $friend_userid );
@@ -532 +540 @@
 
 function friends_accept_friendship( $friendship_id ) {
+    /* Check the nonce */
+    if ( !check_admin_referer( 'friends_accept_friendship' ) ) 
+        return false;
+        
     $friendship = new BP_Friends_Friendship( $friendship_id, true, false );
-    
+
     if ( !$friendship->is_confirmed && BP_Friends_Friendship::accept( $friendship_id ) ) {
         friends_update_friend_totals( $friendship->initiator_user_id, $friendship->friend_user_id );
@@ -555 +567 @@
 
 function friends_reject_friendship( $friendship_id ) {
+    /* Check the nonce */
+    if ( !check_admin_referer( 'friends_reject_friendship' ) ) 
+        return false;
+        
     $friendship = new BP_Friends_Friendship( $friendship_id, true, false );
 

trunk/bp-friends/bp-friends-ajax.php

@@ -4 +4 @@
     global $bp;
 
-    check_ajax_referer('friend_search');
+    check_ajax_referer( 'friends_search' );
     
     load_template( get_template_directory() . '/friends/friends-loop.php' );
@@ -14 +14 @@
 
     if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
+        
+        check_ajax_referer('friends_remove_friend');
+        
         if ( !friends_remove_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
             echo __("Friendship could not be canceled.", 'buddypress');
         } else {
-            echo '<a id="friend-' . $_POST['fid'] . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . $bp->loggedin_user->domain . $bp->friends->slug . '/add-friend/' . $_POST['fid'] . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
+            echo '<a id="friend-' . $_POST['fid'] . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . wp_nonce_url( $bp->loggedin_user->domain . $bp->friends->slug . '/add-friend/' . $_POST['fid'], 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
         }
     } else if ( 'not_friends' == BP_Friends_Friendship::check_is_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
+        
+        check_ajax_referer('friends_add_friend');
+        
         if ( !friends_add_friend( $bp->loggedin_user->id, $_POST['fid'] ) ) {
             echo __("Friendship could not be requested.", 'buddypress');

trunk/bp-friends/bp-friends-templatetags.php

@@ -248 +248 @@
     global $friends_template, $bp;
     
-    echo apply_filters( 'bp_friend_accept_request_link', $bp->loggedin_user->domain . $bp->friends->slug . '/requests/accept/' . $friends_template->friendship->id );
+    echo apply_filters( 'bp_friend_accept_request_link', wp_nonce_url( $bp->loggedin_user->domain . $bp->friends->slug . '/requests/accept/' . $friends_template->friendship->id, 'friends_accept_friendship' ) );
 }
 
@@ -254 +254 @@
     global $friends_template, $bp;
     
-    echo apply_filters( 'bp_friend_reject_request_link', $bp->loggedin_user->domain . $bp->friends->slug . '/requests/reject/' . $friends_template->friendship->id );   
+    echo apply_filters( 'bp_friend_reject_request_link', wp_nonce_url( $bp->loggedin_user->domain . $bp->friends->slug . '/requests/reject/' . $friends_template->friendship->id, 'friends_reject_friendship' ) );  
 }
 
@@ -269 +269 @@
 ?>
     <form action="<?php echo $action ?>" id="friend-search-form" method="post">
+
         <label for="friend-search-box" id="friend-search-label"><?php echo $label ?> <img id="ajax-loader" src="<?php echo $bp->friends->image_base ?>/ajax-loader.gif" height="7" alt="Loading" style="display: none;" /></label>
         <input type="search" name="friend-search-box" id="friend-search-box" value="<?php echo $value ?>"<?php echo $disabled ?> />
-        <?php if ( function_exists('wp_nonce_field') )
-            wp_nonce_field('friend_search' );
-        ?>
+        
+        <?php wp_nonce_field( 'friends_search', '_wpnonce_friend_search' ) ?>
         <input type="hidden" name="initiator" id="initiator" value="<?php echo $bp->displayed_user->id ?>" />
+    
     </form>
 <?php
@@ -318 +319 @@
             echo '<a class="requested" href="' . $bp->loggedin_user->domain . $bp->friends->slug . '">' . __( 'Friendship Requested', 'buddypress' ) . '</a>';
         } else if ( 'is_friend' == $friend_status ) {
-            echo '<a href="' . $bp->loggedin_user->domain . $bp->friends->slug . '/remove-friend/' . $potential_friend_id . '" title="' . __('Cancel Friendship', 'buddypress') . '" id="friend-' . $potential_friend_id . '" rel="remove" class="remove">' . __('Cancel Friendship', 'buddypress') . '</a>';
+            echo '<a href="' . wp_nonce_url( $bp->loggedin_user->domain . $bp->friends->slug . '/remove-friend/' . $potential_friend_id, 'friends_remove_friend' ) . '" title="' . __('Cancel Friendship', 'buddypress') . '" id="friend-' . $potential_friend_id . '" rel="remove" class="remove">' . __('Cancel Friendship', 'buddypress') . '</a>';
         } else {
-            echo '<a href="' . $bp->loggedin_user->domain . $bp->friends->slug . '/add-friend/' . $potential_friend_id . '" title="' . __('Add Friend', 'buddypress') . '" id="friend-' . $potential_friend_id . '" rel="add" class="add">' . __('Add Friend', 'buddypress') . '</a>';
+            echo '<a href="' . wp_nonce_url( $bp->loggedin_user->domain . $bp->friends->slug . '/add-friend/' . $potential_friend_id, 'friends_add_friend' ) . '" title="' . __('Add Friend', 'buddypress') . '" id="friend-' . $potential_friend_id . '" rel="add" class="add">' . __('Add Friend', 'buddypress') . '</a>';
         }
         echo '</div>';
-
-        // This causes duplicates, so it's not feasible as is.
-        // if ( function_exists('wp_nonce_field') )
-        //  wp_nonce_field('addremove_friend');
     }
 }

trunk/bp-friends/js/general.js

@@ -50 +50 @@
                     action: 'friends_search',
                     'cookie': encodeURIComponent(document.cookie),
-                    '_wpnonce': jQuery("input#_wpnonce").val(),
+                    '_wpnonce': jQuery("input#_wpnonce_friend_search").val(),
 
                     'friend-search-box': jQuery("#friend-search-box").val()

trunk/bp-groups.php

@@ -151 +151 @@
     if ( is_site_admin() ) {
         /* Need to check db tables exist, activate hook no-worky in mu-plugins folder. */
-        if ( false == ( $wpdb->get_var("SHOW TABLES LIKE '%" . $bp->groups->table_name . "%'") ) || ( get_site_option('bp-groups-db-version') < BP_GROUPS_DB_VERSION )  )
+        if ( !$wpdb->get_var("SHOW TABLES LIKE '%" . $bp->groups->table_name . "%'") || ( get_site_option('bp-groups-db-version') < BP_GROUPS_DB_VERSION )  )
             groups_install();
             
-        if ( ( function_exists('bp_wire_install') && false == $wpdb->get_var("SHOW TABLES LIKE '%" . $bp->groups->table_name_wire . "%'") ) || ( get_site_option('bp-groups-db-version') < BP_GROUPS_DB_VERSION ) )
+        if ( ( function_exists('bp_wire_install') && !$wpdb->get_var("SHOW TABLES LIKE '%" . $bp->groups->table_name_wire . "%'") ) || ( get_site_option('bp-groups-db-version') < BP_GROUPS_DB_VERSION ) )
             groups_wire_install();
     }
@@ -349 +349 @@
     
     if ( !$create_group_step = $bp->action_variables[1] ) {
-        $create_group_step = '1';
+        $create_group_step = 1;
         $completed_to_step = 0;
         
@@ -366 +366 @@
         $group_obj = new BP_Groups_Group( $_SESSION['group_obj_id'] );
 
-        // If the user skipped the avatar step, move onto the next step and don't save anything.
-        if ( isset( $_POST['skip'] ) && 3 == (int)$create_group_step ) {
+        if ( !$group_id = groups_create_group( $create_group_step, $_SESSION['group_obj_id'] ) ) {
+            bp_core_add_message( __('There was an error saving group details. Please try again.', 'buddypress'), 'error' );
+            bp_core_redirect( $bp->loggedin_user->domain . $bp->groups->slug . '/create/step/' . $create_group_step );
+        } else {
             $create_group_step++;
             $completed_to_step++;
             $_SESSION['completed_to_step'] = $completed_to_step;
-        } else {
-            
-            // We're done.
-            if ( 4 == (int)$create_group_step )
-                bp_core_redirect( bp_group_permalink( $group_obj, false ) );
-            
-            if ( !$group_id = groups_create_group( $create_group_step, $_SESSION['group_obj_id'] ) ) {
-                bp_core_add_message( __('There was an error saving group details. Please try again.', 'buddypress'), 'error' );
-                bp_core_redirect( $bp->loggedin_user->domain . $bp->groups->slug . '/create/step/' . $create_group_step );
-            } else {
-                $create_group_step++;
-                $completed_to_step++;
-                $_SESSION['completed_to_step'] = $completed_to_step;
-                $_SESSION['group_obj_id'] = $group_id;
-            }
+            $_SESSION['group_obj_id'] = $group_id;
         }
+        
+        if ( $completed_to_step == 4 )
+            bp_core_redirect( bp_group_permalink( $group_obj, false ) );
     }
 
@@ -852 +843 @@
             } else {
                 bp_core_add_message( __( 'The group was deleted successfully', 'buddypress' ) );
-                bp_core_redirect( site_url() . '/' . $bp->groups->slug . '/' );
+                bp_core_redirect( $bp->loggedin_user->domain . $bp->groups->slug . '/' );
             }
 
@@ -1345 +1336 @@
             
         switch ( $step ) {
-            case '1':
+            case '1':       
+                if ( !check_admin_referer( 'groups_step1_save' ) )
+                    return false;
+                
                 if ( $_POST['group-name'] != '' && $_POST['group-desc'] != '' ) {
                     $group_obj->creator_id = $bp->loggedin_user->id;
@@ -1395 +1389 @@
             
             case '2':
+                if ( !check_admin_referer( 'groups_step2_save' ) )
+                    return false;
+
                 $group_obj->status = 'public';
                 $group_obj->is_invitation_only = 0;
@@ -1435 +1432 @@
             
             case '3':
-                                
+                if ( !check_admin_referer( 'groups_step3_save' ) )
+                    return false;
+                
+                if ( isset( $_POST['skip'] ) )
+                    return $group_obj->id;
+                
                 // Image already cropped and uploaded, lets store a reference in the DB.
                 if ( !wp_verify_nonce($_POST['nonce'], 'slick_avatars') || !$result = bp_core_avatar_cropstore( $_POST['orig'], $_POST['canvas'], $_POST['v1_x1'], $_POST['v1_y1'], $_POST['v1_w'], $_POST['v1_h'], $_POST['v2_x1'], $_POST['v2_y1'], $_POST['v2_w'], $_POST['v2_h'], false, 'groupavatar', $group_obj->id ) )
@@ -1455 +1457 @@
             
             case '4':
-                $send_invites = groups_send_invites($group_obj);
+                if ( !check_admin_referer( 'groups_step4_save' ) )
+                    return false;
+                    
+                groups_send_invites( $group_obj, true );
                 
                 do_action( 'groups_created_group', $group_obj->id );
@@ -1529 +1534 @@
 function groups_new_group_forum_post( $post_text, $topic_id ) {
     global $group_obj;
+
+    /* Check the nonce */
+    if ( !check_admin_referer( 'bp_forums_new_reply' ) ) 
+        return false;
     
     if ( $forum_post = bp_forums_new_post( $post_text, $topic_id ) ) {
@@ -1547 +1556 @@
 function groups_new_group_forum_topic( $topic_title, $topic_text, $topic_tags, $forum_id ) {
     global $group_obj;
+
+    /* Check the nonce */   
+    if ( !check_admin_referer( 'bp_forums_new_topic' ) ) 
+        return false;
     
     if ( $topic = bp_forums_new_topic( $topic_title, $topic_text, $topic_tags, $forum_id ) ) {
@@ -1565 +1578 @@
 function groups_invite_user( $user_id, $group_id ) {
     global $bp;
+
+    /* Check the nonce */
+    if ( !check_admin_referer( 'groups_invite_uninvite_user' ) )
+        return false;
     
     if ( groups_is_user_member( $user_id, $group_id ) )
@@ -1584 +1601 @@
 }
 
-function groups_uninvite_user( $user_id, $group_id ) {
-    global $bp;
-
+function groups_uninvite_user( $user_id, $group_id, $skip_check = false ) {
+    global $bp;
+
+    /* Because this is called on groups_leave_group() and a nonce has already been
+     * checked, we need a way of overriding a double check.
+     */
+    if ( !$skip_check ) {
+        if ( !check_admin_referer( 'groups_invite_uninvite_user' ) )
+            return false;
+    }
+    
     if ( !BP_Groups_Member::delete( $user_id, $group_id ) )
         return false;
@@ -1597 +1622 @@
 function groups_accept_invite( $user_id, $group_id ) {
     global $group_obj;
+
+    /* Check the nonce */
+    if ( !check_admin_referer( 'groups_accept_invite' ) )
+        return false;
     
     if ( groups_is_user_member( $user_id, $group_id ) )
@@ -1639 +1668 @@
 }
 
-function groups_send_invites( $group_obj ) {
-    global $bp;
-    
+function groups_send_invites( $group_obj, $skip_check = false ) {
+    global $bp;
+
+    if ( !$skip_check ) {
+        if ( !check_admin_referer( 'groups_send_invites' ) )
+            return false;
+    }
+
     // Send friend invites.
     $invited_users = groups_get_invites_for_group( $bp->loggedin_user->id, $group_obj->id );
-
+    
     for ( $i = 0; $i < count( $invited_users ); $i++ ) {
         $member = new BP_Groups_Member( $invited_users[$i], $group_obj->id );
@@ -1650 +1684 @@
         $member->save();
     }
-    
+
     groups_notification_group_invites( $group_obj->id, $invited_users, $bp->loggedin_user->id );
     
@@ -1663 +1697 @@
     global $bp;
     
+    /* Check the nonce */   
+    if ( !check_admin_referer( 'groups_leave_group' ) )
+        return false;
+    
     if ( !$user_id )
         $user_id = $bp->loggedin_user->id;
@@ -1671 +1709 @@
         
     // This is exactly the same as deleting and invite, just is_confirmed = 1 NOT 0.
-    if ( !groups_uninvite_user( $user_id, $group_id ) )
+    if ( !groups_uninvite_user( $user_id, $group_id, true ) )
         return false;
 
@@ -1685 +1723 @@
     global $bp;
     
+    /* Check the nonce */
+    if ( !check_admin_referer( 'groups_join_group' ) ) 
+        return false;
+        
     if ( !$user_id )
         $user_id = $bp->loggedin_user->id;
@@ -1734 +1776 @@
 function groups_new_wire_post( $group_id, $content ) {
     global $group_obj;
-    
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'bp_wire_post' ) ) 
+        return false;
+
     $private = false;
     if ( $group_obj->status != 'public' )
@@ -1751 +1797 @@
     global $bp;
     
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'bp_wire_delete_link' ) )
+        return false;
+    
     if ( bp_wire_delete_post( $wire_post_id, 'groups', $table_name ) ) {        
         do_action( 'groups_deleted_wire_post', $wire_post_id );
@@ -1762 +1812 @@
     global $bp;
     
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_edit_group_details' ) )
+        return false;
+    
     if ( empty( $group_name ) || empty( $group_desc ) )
         return false;
-        
+    
     $group = new BP_Groups_Group( $group_id, false, false );
     $group->name = $group_name;
@@ -1783 +1837 @@
 function groups_edit_group_settings( $group_id, $enable_wire, $enable_forum, $enable_photos, $photos_admin_only, $status ) {
     global $bp;
+    
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_edit_group_settings' ) )
+        return false;
     
     $group = new BP_Groups_Group( $group_id, false, false );
@@ -1808 +1866 @@
 function groups_promote_member( $user_id, $group_id ) {
     global $bp;
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_promote_member' ) )
+        return false;
     
     if ( !$bp->is_item_admin )
@@ -1821 +1883 @@
 function groups_demote_member( $user_id, $group_id ) {
     global $bp;
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_demote_member' ) )
+        return false;
     
     if ( !$bp->is_item_admin )
@@ -1834 +1900 @@
 function groups_ban_member( $user_id, $group_id ) {
     global $bp;
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_ban_member' ) )
+        return false;
     
     if ( !$bp->is_item_admin )
@@ -1847 +1917 @@
 function groups_unban_member( $user_id, $group_id ) {
     global $bp;
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_unban_member' ) )
+        return false;
     
     if ( !$bp->is_item_admin )
@@ -1860 +1934 @@
 function groups_send_membership_request( $requesting_user_id, $group_id ) {
     global $bp;
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_send_membership_request' ) )
+        return false;
 
     $requesting_user = new BP_Groups_Member;
@@ -1888 +1966 @@
 
 function groups_accept_membership_request( $membership_id ) {
+    
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_accept_membership_request' ) )
+        return false;
+
     $membership = new BP_Groups_Member( false, false, $membership_id );
     $membership->accept_request();
@@ -1909 +1992 @@
 
 function groups_reject_membership_request( $membership_id ) {
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_reject_membership_request' ) )
+        return false;
+        
     $membership = new BP_Groups_Member( false, false, $membership_id );
     
@@ -1935 +2023 @@
 function groups_delete_group( $group_id ) {
     global $bp;
+
+    /* Check the nonce first. */
+    if ( !check_admin_referer( 'groups_delete_group' ) )
+        return false;
     
     // Check the user is the group admin.

trunk/bp-groups/bp-groups-ajax.php

@@ -3 +3 @@
     global $bp;
 
-    check_ajax_referer('invite_user');
+    check_ajax_referer( 'groups_invite_uninvite_user' );
 
     if ( !$_POST['friend_id'] || !$_POST['friend_action'] || !$_POST['group_id'] )
@@ -15 +15 @@
     
     if ( 'invite' == $_POST['friend_action'] ) {
+                
         if ( !groups_invite_user( $_POST['friend_id'], $_POST['group_id'] ) )
             return false;
@@ -25 +26 @@
         echo '<span class="activity">' . sprintf( __( 'active %s ago', 'buddypress' ), $user->last_active ) . '</span>';
         echo '<div class="action">
-                <a class="remove" href="' . $bp->loggedin_user->domain . $bp->groups->slug . '/' . $_POST['group_id'] . '/invites/remove/' . $user->id . '" id="uid-' . $user->id . '">' . __( 'Remove Invite', 'buddypress' ) . '</a> 
+                <a class="remove" href="' . wp_nonce_url( $bp->loggedin_user->domain . $bp->groups->slug . '/' . $_POST['group_id'] . '/invites/remove/' . $user->id, 'groups_invite_uninvite_user' ) . '" id="uid-' . $user->id . '">' . __( 'Remove Invite', 'buddypress' ) . '</a> 
               </div>';
         echo '</li>';
         
     } else if ( 'uninvite' == $_POST['friend_action'] ) {
+        
         if ( !groups_uninvite_user( $_POST['friend_id'], $_POST['group_id'] ) )
             return false;
         
         return true;
+        
     } else {
         return false;
@@ -43 +46 @@
     global $bp;
 
-    check_ajax_referer('group-filter-box');
+    check_ajax_referer( 'group-filter-box' );
     
     load_template( get_template_directory() . '/groups/group-loop.php' );
@@ -140 +143 @@
 
         <div id="message" class="info">
-            <p>This group has no members.</p>
+            <p><?php _e( 'This group has no members.', 'buddypress' ) ?></p>
         </div>
 
@@ -186 +189 @@
 
         <div id="message" class="info">
-            <p>This group has no members.</p>
+            <p><?php _e( 'This group has no members.', 'buddypress' ) ?></p>
         </div>
 
@@ -297 +300 @@
     
     if ( !groups_is_user_member( $bp->loggedin_user->id, $group->id ) ) {
-    
+
         if ( 'public' == $group->status ) {
+            
+            check_ajax_referer( 'groups_join_group' );
+            
             if ( !groups_join_group( $group->id ) ) {
                 _e( 'Error joining group', 'buddypress' );
             } else {
-                echo '<a id="group-' . $group->id . '" class="leave-group" rel="leave" title="' . __( 'Leave Group', 'buddypress' ) . '" href="' . bp_group_permalink( $group, false ) . '/leave-group">' . __( 'Leave Group', 'buddypress' ) . '</a>';
-            }           
+                echo '<a id="group-' . $group->id . '" class="leave-group" rel="leave" title="' . __( 'Leave Group', 'buddypress' ) . '" href="' . wp_nonce_url( bp_group_permalink( $group, false ) . '/leave-group', 'groups_leave_group' ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';
+            }   
+                    
         } else if ( 'private' == $group->status ) {
+            
+            check_ajax_referer( 'groups_send_membership_request' );
+            
             if ( !groups_send_membership_request( $bp->loggedin_user->id, $group->id ) ) {
                 _e( 'Error requesting membership', 'buddypress' );  
@@ -313 +323 @@
         
     } else {
+
+        check_ajax_referer( 'groups_leave_group' );
+
         if ( !groups_leave_group( $group->id ) ) {
             _e( 'Error leaving group', 'buddypress' );
         } else {
             if ( 'public' == $group->status ) {
-                echo '<a id="group-' . $group->id . '" class="join-group" rel="join" title="' . __( 'Join Group', 'buddypress' ) . '" href="' . bp_group_permalink( $group, false ) . '/join">' . __( 'Join Group', 'buddypress' ) . '</a>';                
+                echo '<a id="group-' . $group->id . '" class="join-group" rel="join" title="' . __( 'Join Group', 'buddypress' ) . '" href="' . wp_nonce_url( bp_group_permalink( $group, false ) . '/join', 'groups_join_group' ) . '">' . __( 'Join Group', 'buddypress' ) . '</a>';              
             } else if ( 'private' == $group->status ) {
-                echo '<a id="group-' . $group->id . '" class="request-membership" rel="join" title="' . __( 'Request Membership', 'buddypress' ) . '" href="' . bp_group_permalink( $group, false ) . '/request-membership">' . __( 'Request Membership', 'buddypress' ) . '</a>';
+                echo '<a id="group-' . $group->id . '" class="request-membership" rel="join" title="' . __( 'Request Membership', 'buddypress' ) . '" href="' . wp_nonce_url( bp_group_permalink( $group, false ) . '/request-membership', 'groups_send_membership_request' ) . '">' . __( 'Request Membership', 'buddypress' ) . '</a>';
             }
         }

trunk/bp-groups/bp-groups-classes.php

@@ -164 +164 @@
         }
         
-        if ( false == $wpdb->query($sql) )
+        if ( false === $wpdb->query($sql) )
             return false;
         

trunk/bp-groups/bp-groups-templatetags.php

@@ -688 +688 @@
     global $members_template, $groups_template, $bp;
 
-    echo apply_filters( 'bp_group_member_promote_link', bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/promote/' . $members_template->member->user_id );
+    echo apply_filters( 'bp_group_member_promote_link', wp_nonce_url( bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/promote/' . $members_template->member->user_id, 'groups_promote_member' ) );
 }
 
@@ -697 +697 @@
         $user_id = $members_template->member->user_id;
     
-    echo apply_filters( 'bp_group_member_demote_link', bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/demote/' . $user_id );
+    echo apply_filters( 'bp_group_member_demote_link', wp_nonce_url( bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/demote/' . $user_id, 'groups_demote_member' ) );
 }
 
@@ -703 +703 @@
     global $members_template, $groups_template, $bp;
     
-    echo apply_filters( 'bp_group_member_ban_link', bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/ban/' . $members_template->member->user_id );
+    echo apply_filters( 'bp_group_member_ban_link', wp_nonce_url( bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/ban/' . $members_template->member->user_id, 'groups_ban_member' ) );
 }
 
@@ -709 +709 @@
     global $members_template, $groups_template, $bp;
     
-    echo apply_filters( 'bp_group_member_unban_link', bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/unban/' . $members_template->member->user_id ); 
+    echo apply_filters( 'bp_group_member_unban_link', wp_nonce_url( bp_group_permalink( $groups_template->group, false ) . '/admin/manage-members/unban/' . $members_template->member->user_id, 'groups_unban_member' ) );  
 }
 
@@ -822 +822 @@
             
             <p><input type="submit" value="<?php _e('Create Group and Continue', 'buddypress') ?> &raquo;" id="save" name="save"/></p>
+            
+            <?php wp_nonce_field( 'groups_step1_save' ) ?>
         <?php break; ?>
         
@@ -867 +869 @@
 
                 <p><input type="submit" value="<?php _e('Save and Continue', 'buddypress') ?> &raquo;" id="save" name="save"/></p>
+
+                <?php wp_nonce_field( 'groups_step2_save' ) ?>
             <?php } else { ?>
                 <div id="message" class="info">
@@ -895 +899 @@
                     </div>
                 </div>
+                
+                <?php wp_nonce_field( 'groups_step3_save' ) ?>
             <?php } else { ?>
                 <div id="message" class="info">
@@ -918 +924 @@
                 } ?>
                 
-                <p class="clear"><input type="button" value="<?php _e('Finish', 'buddypress') ?> &raquo;" id="save" name="save" onclick="location.href='<?php echo $group_link ?>'" /></p>
+                <p class="clear"><input type="submit" value="<?php _e('Finish', 'buddypress') ?> &raquo;" id="save" name="save" /></p>
+                
+                <?php wp_nonce_field( 'groups_step4_save' ) ?>
+                
                 <?php
             } else { ?>
@@ -1018 +1027 @@
     global $groups_template, $bp;
     
-    echo apply_filters( 'bp_group_accept_invite_link', $bp->loggedin_user->domain . $bp->groups->slug . '/invites/accept/' . $groups_template->group->id ); 
+    echo apply_filters( 'bp_group_accept_invite_link', wp_nonce_url( $bp->loggedin_user->domain . $bp->groups->slug . '/invites/accept/' . $groups_template->group->id, 'groups_accept_invite' ) ); 
 }
 
@@ -1024 +1033 @@
     global $groups_template, $bp;
     
-    echo apply_filters( 'bp_group_reject_invite_link', $bp->loggedin_user->domain . $bp->groups->slug . '/invites/reject/' . $groups_template->group->id );
+    echo apply_filters( 'bp_group_reject_invite_link', wp_nonce_url( $bp->loggedin_user->domain . $bp->groups->slug . '/invites/reject/' . $groups_template->group->id, 'groups_reject_invite' ) );
 }
 
@@ -1042 +1051 @@
     global $groups_template, $bp;
     
-    echo apply_filters( 'bp_group_leave_confirm_link', bp_group_permalink( false, true ) . '/leave-group/yes' );    
+    echo apply_filters( 'bp_group_leave_confirm_link', wp_nonce_url( bp_group_permalink( false, true ) . '/leave-group/yes', 'groups_leave_group' ) );  
 }
 
@@ -1060 +1069 @@
         <h4><?php _e( 'Select Friends', 'buddypress' ) ?> <img id="ajax-loader" src="<?php echo $bp->groups->image_base ?>/ajax-loader.gif" height="7" alt="Loading" style="display: none;" /></h4>
         <?php bp_group_list_invite_friends() ?>
-        <?php wp_nonce_field( 'invite_user' ) ?>
+        <?php wp_nonce_field( 'groups_invite_uninvite_user', '_wpnonce_invite_uninvite_user' ) ?>
         <input type="hidden" name="group_id" id="group_id" value="<?php echo $group_obj->id ?>" />
     </div>
@@ -1081 +1090 @@
                     <span class="activity"><?php echo $user->last_active ?></span>
                     <div class="action">
-                        <a class="remove" href="<?php echo site_url() . $bp->groups->slug . '/' . $group_obj->id . '/invites/remove/' . $user->id ?>" id="uid-<?php echo $user->id ?>"><?php _e( 'Remove Invite', 'buddypress' ) ?></a> 
+                        <a class="remove" href="<?php echo wp_nonce_url( site_url( $bp->groups->slug . '/' . $group_obj->id . '/invites/remove/' . $user->id ), 'groups_invite_uninvite_user' ) ?>" id="uid-<?php echo $user->id ?>"><?php _e( 'Remove Invite', 'buddypress' ) ?></a> 
                     </div>
                 </li>
@@ -1087 +1096 @@
         </ul>
         
+        <?php wp_nonce_field( 'groups_send_invites', '_wpnonce_send_invites' ) ?>
     </div>
 <?php
@@ -1130 +1140 @@
         case 'public':
             if ( BP_Groups_Member::check_is_member( $bp->loggedin_user->id, $group->id ) )
-                echo '<a class="leave-group" href="' . bp_group_permalink( $group, false ) . '/leave-group">' . __('Leave Group', 'buddypress') . '</a>';                                   
+                echo '<a class="leave-group" href="' . wp_nonce_url( bp_group_permalink( $group, false ) . '/leave-group', 'groups_leave_group' ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';                                  
             else
-                echo '<a class="join-group" href="' . bp_group_permalink( $group, false ) . '/join">' . __('Join Group', 'buddypress') . '</a>';                    
+                echo '<a class="join-group" href="' . wp_nonce_url( bp_group_permalink( $group, false ) . '/join', 'groups_join_group' ) . '">' . __( 'Join Group', 'buddypress' ) . '</a>';                    
         break;
         
         case 'private':
             if ( BP_Groups_Member::check_is_member( $bp->loggedin_user->id, $group->id ) ) {
-                echo '<a class="leave-group" href="' . bp_group_permalink( $group, false ) . '/leave-group">' . __('Leave Group', 'buddypress') . '</a>';                                       
+                echo '<a class="leave-group" href="' . wp_nonce_url( bp_group_permalink( $group, false ) . '/leave-group', 'groups_leave_group' ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';                                      
             } else {
                 if ( !bp_group_has_requested_membership( $group ) )
-                    echo '<a class="request-membership" href="' . bp_group_permalink( $group, false ) . '/request-membership">' . __('Request Membership', 'buddypress') . '</a>';      
+                    echo '<a class="request-membership" href="' . wp_nonce_url( bp_group_permalink( $group, false ) . '/request-membership', 'groups_send_membership_request' ) . '">' . __('Request Membership', 'buddypress') . '</a>';       
                 else
-                    echo '<a class="membership-requested" href="' . bp_group_permalink( $group, false ) . '">' . __('Membership Requested', 'buddypress') . '</a>';             
+                    echo '<a class="membership-requested" href="' . bp_group_permalink( $group, false ) . '">' . __( 'Request Sent', 'buddypress' ) . '</a>';               
             }
         break;

trunk/bp-groups/js/directory-groups.js

@@ -6 +6 @@
             jQuery("div#groups-list-options a").removeClass("selected");
             jQuery(this).addClass('selected');
+            jQuery("input#groups_search").val('');
 
             var letter = jQuery(this).attr('id')
@@ -158 +159 @@
             gid = gid.split('-');
             gid = gid[1];
-
+            
+            var nonce = jQuery(this).attr('href');
+            nonce = nonce.split('?_wpnonce=');
+            nonce = nonce[1].split('&');
+            nonce = nonce[0];
+            
             var thelink = jQuery(this);
 
@@ -164 +170 @@
                 action: 'joinleave_group',
                 'cookie': encodeURIComponent(document.cookie),
-                'gid': gid
+                'gid': gid,
+                '_wpnonce': nonce
             },
             function(response)

trunk/bp-groups/js/general.js

@@ -22 +22 @@
                 'friend_action': friend_action,
                 'cookie': encodeURIComponent(document.cookie),
-                '_wpnonce': jQuery("input#_wpnonce").val(),
+                '_wpnonce': jQuery("input#_wpnonce_invite_uninvite_user").val(),
                 'friend_id': friend_id,
                 'group_id': jQuery("input#group_id").val()
@@ -55 +55 @@
                 'friend_action': 'uninvite',
                 'cookie': encodeURIComponent(document.cookie),
-                '_wpnonce': jQuery("input#_wpnonce").val(),
+                '_wpnonce': jQuery("input#_wpnonce_invite_uninvite_user").val(),
                 'friend_id': friend_id,
                 'group_id': jQuery("input#group_id").val()

trunk/bp-messages.php

@@ -123 +123 @@
     if ( is_site_admin() ) {
         /* Need to check db tables exist, activate hook no-worky in mu-plugins folder. */
-        if ( false == ( $wpdb->get_var( "SHOW TABLES LIKE '%{$bp->messages->table_name_messages}%'" ) ) || ( get_site_option('bp-messages-db-version') < BP_MESSAGES_DB_VERSION ) )
+        if ( !$wpdb->get_var( "SHOW TABLES LIKE '%{$bp->messages->table_name_messages}%'" ) || ( get_site_option('bp-messages-db-version') < BP_MESSAGES_DB_VERSION ) )
             messages_install();
     }
@@ -389 +389 @@
     global $bp, $current_user;
     
+    if ( !check_admin_referer( 'messages_send_message' ) )
+        return false;
+    
     messages_add_callback_values( $recipients, $subject, $content );
     
@@ -515 +518 @@
 
 function messages_send_notice( $subject, $message, $from_template ) {
+    
+    
     if ( !is_site_admin() || empty( $subject ) || empty( $message ) ) {
         return false;
@@ -539 +544 @@
 
 function messages_delete_thread( $thread_ids ) {
+    if ( !check_admin_referer( 'messages_delete_thread' ) )
+        return false;
+    
     if ( is_array($thread_ids) ) {
         $error = 0;
@@ -571 +579 @@
 
 
-/**************************************************************************
- messages_view_thread()
-  
- Displays a message thread.
- **************************************************************************/
-
-function messages_view_thread( $thread_id ) {
-    global $bp;
-
-    $thread = new BP_Messages_Thread( $thread_id, true );
-    
-    if ( !$thread->has_access ) {
-        unset($_GET['mode']); ?>
-        <div id="message" class="error">
-            <p><?php _e( 'There was an error when viewing that message', 'buddypress' ) ?></p>
-        </div>
-    <?php   
-    } else {
-        if ( $thread->messages ) { ?>
-            <?php $thread->mark_read() ?>
-                
-            <div class="wrap">
-                <h2 id="message-subject"><?php echo $thread->subject; ?></h2>
-                <table class="form-table">
-                    <tbody>
-                        <tr>
-                            <td>
-                                <img src="<?php echo $bp->messages->image_base ?>/email_open.gif" alt="Message" style="vertical-align: top;" /> &nbsp;
-                                <?php _e('Sent between ', 'buddypress') ?> <?php echo BP_Messages_Thread::get_recipient_links($thread->recipients) ?> 
-                                <?php _e('and', 'buddypress') ?> <?php echo bp_core_get_userlink($bp->loggedin_user->id) ?>. 
-                            </td>
-                        </tr>
-                    </tbody>
-                </table>
-                
-        <?php
-            foreach ( $thread->messages as $message ) {
-                ?>
-                    <a name="<?php echo 'm-' . $message->id ?>"></a>
-                    <div class="message-box">
-                        <div class="avatar-box">
-                            <?php echo apply_filters( 'bp_message_sender_avatar', bp_core_get_avatar( $message->sender_id, 1 ) ) ?>
-                            <h3><?php echo apply_filters( 'bp_message_sender_id', bp_core_get_userlink( $message->sender_id ) ) ?></h3>
-                            <small><?php echo apply_filters( 'bp_message_date_sent', bp_format_time( strtotime($message->date_sent ) ) ) ?></small>
-                        </div>
-                        <?php echo apply_filters( 'bp_message_content', stripslashes($message->message) ); ?>
-                        <div class="clear"></div>
-                    </div>
-                <?php
-            }
-        
-            ?>
-                <form id="send-reply" action="<?php echo get_option('home'); ?>/wp-admin/admin.php?page=bp-messages.php&amp;mode=send" method="post">
-                    <div class="message-box">
-                            <div id="messagediv">
-                                <div class="avatar-box">
-                                    <?php if ( function_exists('bp_core_get_avatar') ) 
-                                        echo bp_core_get_avatar($bp->loggedin_user->id, 1);
-                                    ?>
-                    
-                                    <h3><?php _e("Reply: ", 'buddypress') ?></h3>
-                                </div>
-                                <label for="reply"></label>
-                                <div>
-                                    <textarea name="content" id="message_content" rows="15" cols="40"><?php echo $content; ?></textarea>
-                                </div>
-                            </div>
-                            <p class="submit">
-                                <input type="submit" name="send" value="Send Reply &raquo;" id="send_reply_button"/>
-                            </p>
-                            <input type="hidden" id="thread_id" name="thread_id" value="<?php echo $thread->thread_id ?>" />
-                            <input type="hidden" name="subject" id="subject" value="<?php _e('Re: ', 'buddypress'); echo str_replace( 'Re: ', '', $thread->last_message_subject); ?>" />
-                    </div>
-                    <?php if ( function_exists('wp_nonce_field') )
-                        wp_nonce_field('messages_sendreply');
-                    ?>
-                </form>
-            </div>
-            <?php
-        }
-    }
-}
 
 // List actions to clear super cached pages on, if super cache is installed

trunk/bp-messages/bp-messages-ajax.php

@@ -4 +4 @@
     global $bp;
     
-    check_ajax_referer('messages_sendreply');
+    check_ajax_referer( 'messages_send_message' );
     
     $result = messages_send_message($_REQUEST['send_to'], $_REQUEST['subject'], $_REQUEST['content'], $_REQUEST['thread_id'], true, false, true); 

trunk/bp-messages/bp-messages-templatetags.php

@@ -152 +152 @@
 function bp_message_thread_delete_link() {
     global $messages_template, $bp;
-    echo apply_filters( 'bp_message_thread_delete_link', $bp->loggedin_user->domain . $bp->messages->slug . '/' . $bp->current_action . '/delete/' . $messages_template->thread->thread_id );
+    echo apply_filters( 'bp_message_thread_delete_link', wp_nonce_url( $bp->loggedin_user->domain . $bp->messages->slug . '/' . $bp->current_action . '/delete/' . $messages_template->thread->thread_id, 'messages_delete_thread' ) );
 }
 
@@ -263 +263 @@
     global $messages_template, $bp;
     
-    echo apply_filters( 'bp_message_notice_delete_link', $bp->loggedin_user->domain . $bp->messages->slug . '/notices/delete/' . $messages_template->thread->id );
+    echo apply_filters( 'bp_message_notice_delete_link', wp_nonce_url( $bp->loggedin_user->domain . $bp->messages->slug . '/notices/delete/' . $messages_template->thread->id, 'messages_delete_thread' ) );
 }
 
@@ -270 +270 @@
 
     if ( 1 == (int)$messages_template->thread->is_active ) {
-        $link = $bp->loggedin_user->domain . $bp->messages->slug . '/notices/deactivate/' . $messages_template->thread->id;
+        $link = wp_nonce_url( $bp->loggedin_user->domain . $bp->messages->slug . '/notices/deactivate/' . $messages_template->thread->id, 'messages_deactivate_notice' );
     } else {
-        $link = $bp->loggedin_user->domain . $bp->messages->slug . '/notices/activate/' . $messages_template->thread->id;       
+        $link = wp_nonce_url( $bp->loggedin_user->domain . $bp->messages->slug . '/notices/activate/' . $messages_template->thread->id, 'messages_activate_notice' );       
     }
     echo apply_filters( 'bp_message_activate_deactivate_link', $link );
@@ -303 +303 @@
                 <h5><?php echo stripslashes($notice->subject) ?></h5>
                 <?php echo stripslashes($notice->message) ?>
-                <a href="#" id="close-notice">Close</a>
+                <a href="#" id="close-notice"><?php _e( 'Close', 'buddypress' ) ?></a>
             </div>
             <?php
@@ -352 +352 @@
     echo $_GET['r'];
 }
+
+function messages_view_thread( $thread_id ) {
+    global $bp;
+
+    $thread = new BP_Messages_Thread( $thread_id, true );
+    
+    if ( !$thread->has_access ) {
+        unset($_GET['mode']); ?>
+        <div id="message" class="error">
+            <p><?php _e( 'There was an error when viewing that message', 'buddypress' ) ?></p>
+        </div>
+    <?php   
+    } else {
+        if ( $thread->messages ) { ?>
+            <?php $thread->mark_read() ?>
+                
+            <div class="wrap">
+                <h2 id="message-subject"><?php echo $thread->subject; ?></h2>
+                <table class="form-table">
+                    <tbody>
+                        <tr>
+                            <td>
+                                <img src="<?php echo $bp->messages->image_base ?>/email_open.gif" alt="Message" style="vertical-align: top;" /> &nbsp;
+                                <?php _e('Sent between ', 'buddypress') ?> <?php echo BP_Messages_Thread::get_recipient_links($thread->recipients) ?> 
+                                <?php _e('and', 'buddypress') ?> <?php echo bp_core_get_userlink($bp->loggedin_user->id) ?>. 
+                            </td>
+                        </tr>
+                    </tbody>
+                </table>
+                
+        <?php
+            foreach ( $thread->messages as $message ) {
+                ?>
+                    <a name="<?php echo 'm-' . $message->id ?>"></a>
+                    <div class="message-box">
+                        <div class="avatar-box">
+                            <?php echo apply_filters( 'bp_message_sender_avatar', bp_core_get_avatar( $message->sender_id, 1 ) ) ?>
+                            <h3><?php echo apply_filters( 'bp_message_sender_id', bp_core_get_userlink( $message->sender_id ) ) ?></h3>
+                            <small><?php echo apply_filters( 'bp_message_date_sent', bp_format_time( strtotime($message->date_sent ) ) ) ?></small>
+                        </div>
+                        <?php echo apply_filters( 'bp_message_content', stripslashes($message->message) ); ?>
+                        <div class="clear"></div>
+                    </div>
+                <?php
+            }
+        
+            ?>
+                <form id="send-reply" action="<?php echo get_option('home'); ?>/wp-admin/admin.php?page=bp-messages.php&amp;mode=send" method="post">
+                    <div class="message-box">
+                            <div id="messagediv">
+                                <div class="avatar-box">
+                                    <?php if ( function_exists('bp_core_get_avatar') ) 
+                                        echo bp_core_get_avatar($bp->loggedin_user->id, 1);
+                                    ?>
+                    
+                                    <h3><?php _e("Reply: ", 'buddypress') ?></h3>
+                                </div>
+                                <label for="reply"></label>
+                                <div>
+                                    <textarea name="content" id="message_content" rows="15" cols="40"><?php echo $content; ?></textarea>
+                                </div>
+                            </div>
+                            <p class="submit">
+                                <input type="submit" name="send" value="Send Reply &raquo;" id="send_reply_button"/>
+                            </p>
+                            <input type="hidden" id="thread_id" name="thread_id" value="<?php echo $thread->thread_id ?>" />
+                            <input type="hidden" name="subject" id="subject" value="<?php _e('Re: ', 'buddypress'); echo str_replace( 'Re: ', '', $thread->last_message_subject); ?>" />
+                    </div>
+                    
+                    <?php wp_nonce_field( 'messages_send_message', '_wpnonce_send_message' ) ?>
+                </form>
+            </div>
+            <?php
+        }
+    }
+}
+
 ?>

trunk/bp-messages/js/general.php

@@ -40 +40 @@
                 action: 'messages_send_reply',
                 'cookie': encodeURIComponent(document.cookie),
-                '_wpnonce': jQuery("input#_wpnonce").val(),
+                '_wpnonce': jQuery("input#_wpnonce_send_message").val(),
                 
                 'content': jQuery("#message_content").val(),

trunk/bp-wire/bp-wire-templatetags.php

@@ -304 +304 @@
     if ( ( $wire_posts_template->wire_post->user_id == $bp->loggedin_user->id ) || $bp->is_item_admin ) {
         if ( $bp->wire->slug == $bp->current_component || $bp->profile->slug == $bp->current_component ) {
-            echo apply_filters( 'bp_wire_delete_link', '<a href="' . $bp->displayed_user->domain . $bp->wire->slug . '/delete/' . $wire_posts_template->wire_post->id . '">[' . __('Delete', 'buddypress') . ']</a>' );
+            echo apply_filters( 'bp_wire_delete_link', '<a href="' . wp_nonce_url( $bp->displayed_user->domain . $bp->wire->slug . '/delete/' . $wire_posts_template->wire_post->id, 'bp_wire_delete_link' ) . '">[' . __('Delete', 'buddypress') . ']</a>' );
         } else {
-            echo apply_filters( 'bp_wire_delete_link', '<a href="' . site_url() . '/' . $bp->{$bp->current_component}->slug . '/' . $uri . '/wire/delete/' . $wire_posts_template->wire_post->id . '">[' . __('Delete', 'buddypress') . ']</a>' );
+            echo apply_filters( 'bp_wire_delete_link', '<a href="' . wp_nonce_url( site_url( $bp->{$bp->current_component}->slug . '/' . $uri . '/wire/delete/' . $wire_posts_template->wire_post->id ), 'bp_wire_delete_link' ) . '">[' . __('Delete', 'buddypress') . ']</a>' );
         }
     }

trunk/bp-xprofile.php

@@ -188 +188 @@
 
     /* Need to check db tables exist, activate hook no-worky in mu-plugins folder. */
-    if ( false == ( $wpdb->get_var("SHOW TABLES LIKE '%{$bp->profile->table_name_groups}%'") ) || ( get_site_option('bp-xprofile-db-version') < BP_XPROFILE_DB_VERSION )  )
+    if ( !$wpdb->get_var("SHOW TABLES LIKE '%{$bp->profile->table_name_groups}%'") || ( get_site_option('bp-xprofile-db-version') < BP_XPROFILE_DB_VERSION )  )
         xprofile_install();
     
-    if ( ( function_exists('bp_wire_install') && false == $wpdb->get_var( "SHOW TABLES LIKE '%{$bp->profile->table_name_wire}%'" ) ) || ( get_site_option('bp-xprofile-db-version') < BP_XPROFILE_DB_VERSION )  )
+    if ( ( function_exists('bp_wire_install') && !$wpdb->get_var( "SHOW TABLES LIKE '%{$bp->profile->table_name_wire}%'" ) ) || ( get_site_option('bp-xprofile-db-version') < BP_XPROFILE_DB_VERSION )  )
         xprofile_wire_install();
 }
@@ -345 +345 @@
 function xprofile_action_delete_avatar() {
     global $bp;
-    
+
     if ( 'delete-avatar' != $bp->current_action )
+        return false;
+
+    if ( !check_admin_referer( 'bp_delete_avatar_link' ) )
         return false;
     
@@ -370 +373 @@
 function xprofile_action_new_wire_post() {
     global $bp;
-    
+
     if ( $bp->current_component != $bp->wire->slug )
         return false;
@@ -376 +379 @@
     if ( 'post' != $bp->current_action )
         return false;
-    
+        
+    /* Check the nonce */
+    if ( !check_admin_referer( 'bp_wire_post' ) ) 
+        return false;
+        
     if ( !$wire_post_id = bp_wire_new_post( $bp->displayed_user->id, $_POST['wire-post-textarea'], $bp->profile->slug, false, $bp->profile->table_name_wire ) ) {
         bp_core_add_message( __('Wire message could not be posted. Please try again.', 'buddypress'), 'error' );
@@ -625 +632 @@
                 // Loop through each field in the group
                 for ( $j = 0; $j < count($group->fields); $j++ ) {
-                    
+                                        
                     // Create a new field object for this field based on the field ID.
                     $field = new BP_XProfile_Field( $group->fields[$j]->id );
@@ -634 +641 @@
                     // If the user has submitted the form - validate and save the new value for this field
                     if ( isset($_GET['mode']) && 'save' == $_GET['mode'] ) {
+                        
+                        /* Check the nonce */
+                        if ( !check_admin_referer( 'bp_xprofile_edit' ) ) 
+                            return false;
                         
                         // If the current field is a datebox, we need to append '_day' to the end of the field name
@@ -719 +730 @@
                                 <input type="submit" name="save" id="save" value="'.__('Save Changes &raquo;', 'buddypress').'" />
                                </p>';
+                            
+                $list_html .= wp_nonce_field( 'bp_xprofile_edit' );
 
                 // If the user submitted the form to save new values, and there were errors, make sure we display them.