Changeset 11449

Timestamp:

03/08/2017 04:37:18 PM (8 years ago)

Author:

boonebgorges

Message:

Improved nonce protection for some front-end AJAX endpoints.

Location:

trunk/src

Files:

• bp-messages/bp-messages-template.php (modified) (2 diffs)
• bp-templates/bp-legacy/buddypress-functions.php (modified) (7 diffs)
• bp-templates/bp-legacy/js/buddypress.js (modified) (6 diffs)

trunk/src/bp-messages/bp-messages-template.php

@@ -943 +943 @@
         <a href="#" id="mark_as_unread"><?php _ex('Mark as Unread', 'Message management markup', 'buddypress') ?></a> &nbsp;
 
+        <?php wp_nonce_field( 'bp_messages_mark_messages_read', 'mark-messages-read-nonce', false ); ?>
+        <?php wp_nonce_field( 'bp_messages_mark_messages_unread', 'mark-messages-unread-nonce', false ); ?>
+
     <?php endif; ?>
 
     <a href="#" id="delete_<?php echo bp_current_action(); ?>_messages"><?php _e( 'Delete Selected', 'buddypress' ); ?></a> &nbsp;
-
+    <?php wp_nonce_field( 'bp_messages_delete_selected', 'delete-selected-nonce', false ); ?>
 <?php
 }
@@ -1266 +1269 @@
                     <?php echo stripslashes( wp_filter_kses( $notice->message) ) ?>
                     <a href="#" id="close-notice"><?php _e( 'Close', 'buddypress' ) ?></a>
+                    <?php wp_nonce_field( 'bp_messages_close_notice', 'close-notice-nonce' ); ?>
                 </p>
             </div>

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -876 +876 @@
         case 'mentions':
             $feed_url = bp_loggedin_user_domain() . bp_get_activity_slug() . '/mentions/feed/';
-            bp_activity_clear_new_mentions( bp_loggedin_user_id() );
+
+            if ( isset( $_POST['_wpnonce_activity_filter'] ) && wp_verify_nonce( wp_unslash( $_POST['_wpnonce_activity_filter'] ), 'activity_filter' ) ) {
+                bp_activity_clear_new_mentions( bp_loggedin_user_id() );
+            }
+
             break;
         default:
@@ -1198 +1202 @@
         return;
 
+    if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( wp_unslash( $_POST['nonce'] ), 'mark_favorite' ) ) {
+        return;
+    }
+
     if ( bp_activity_add_user_favorite( $_POST['id'] ) )
         _e( 'Remove Favorite', 'buddypress' );
@@ -1217 +1225 @@
     if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
         return;
+
+    if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( wp_unslash( $_POST['nonce'] ), 'unmark_favorite' ) ) {
+        return;
+    }
 
     if ( bp_activity_remove_user_favorite( $_POST['id'] ) )
@@ -1527 +1539 @@
         return;
 
-    if ( ! isset( $_POST['notice_id'] ) ) {
+    $nonce_check = isset( $_POST['nonce'] ) && wp_verify_nonce( wp_unslash( $_POST['nonce'] ), 'bp_messages_close_notice' );
+
+    if ( ! $nonce_check || ! isset( $_POST['notice_id'] ) ) {
         echo "-1<div id='message' class='error'><p>" . __( 'There was a problem closing the notice.', 'buddypress' ) . '</p></div>';
 
@@ -1604 +1618 @@
  * Mark a private message as unread in your inbox via a POST request.
  *
+ * No longer used.
+ *
  * @since 1.2.0
+ * @deprecated 2.2.0
  *
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_ajax_message_markunread() {
-    // Bail if not a POST action.
-    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
-        return;
-
-    if ( ! isset($_POST['thread_ids']) ) {
-        echo "-1<div id='message' class='error'><p>" . __( 'There was a problem marking messages as unread.', 'buddypress' ) . '</p></div>';
-
-    } else {
-        $thread_ids = explode( ',', $_POST['thread_ids'] );
-
-        for ( $i = 0, $count = count( $thread_ids ); $i < $count; ++$i ) {
-            BP_Messages_Thread::mark_as_unread( (int) $thread_ids[$i] );
-        }
-    }
-
-    exit;
+    die( '-1' );
 }
 
@@ -1630 +1632 @@
  * Mark a private message as read in your inbox via a POST request.
  *
+ * No longer used.
+ *
  * @since 1.2.0
+ * @deprecated 2.2.0
  *
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_ajax_message_markread() {
-    // Bail if not a POST action.
-    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
-        return;
-
-    if ( ! isset($_POST['thread_ids']) ) {
-        echo "-1<div id='message' class='error'><p>" . __('There was a problem marking messages as read.', 'buddypress' ) . '</p></div>';
-
-    } else {
-        $thread_ids = explode( ',', $_POST['thread_ids'] );
-
-        for ( $i = 0, $count = count( $thread_ids ); $i < $count; ++$i ) {
-            BP_Messages_Thread::mark_as_read( (int) $thread_ids[$i] );
-        }
-    }
-
-    exit;
+    die( '-1' );
 }
 
@@ -1656 +1646 @@
  * Delete a private message(s) in your inbox via a POST request.
  *
+ * No longer used.
+ *
  * @since 1.2.0
+ * @deprecated 2.2.0
  *
  * @return string|null HTML
  */
 function bp_legacy_theme_ajax_messages_delete() {
-    // Bail if not a POST action.
-    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
-        return;
-
-    if ( ! isset($_POST['thread_ids']) ) {
-        echo "-1<div id='message' class='error'><p>" . __( 'There was a problem deleting messages.', 'buddypress' ) . '</p></div>';
-
-    } else {
-        $thread_ids = wp_parse_id_list( $_POST['thread_ids'] );
-        messages_delete_thread( $thread_ids );
-
-        _e( 'Messages deleted.', 'buddypress' );
-    }
-
-    exit;
+    die( '-1' );
 }
 

trunk/src/bp-templates/bp-legacy/js/buddypress.js

@@ -317 +317 @@
             parent    = target.closest('.activity-item');
             parent_id = parent.attr('id').substr( 9, parent.attr('id').length );
+            nonce     = bp_get_query_var( '_wpnonce', target.attr( 'href' ) );
 
             target.addClass('loading');
@@ -323 +324 @@
                 action: 'activity_mark_' + type,
                 'cookie': bp_get_cookies(),
-                'id': parent_id
+                'id': parent_id,
+                nonce: nonce
             },
             function(response) {
@@ -1490 +1492 @@
     );
 
-    /* Marking private messages as read and unread */
-    jq('#mark_as_read, #mark_as_unread').click(function() {
-        var checkboxes_tosend = '',
-            checkboxes = jq('#message-threads tr td input[type="checkbox"]'),
-            currentClass, newClass, unreadCount, inboxCount, unreadCountDisplay, action,
-            inboxcount, thread_count;
-
-        if ( 'mark_as_unread' === jq(this).attr('id') ) {
-            currentClass = 'read';
-            newClass = 'unread';
-            unreadCount = 1;
-            inboxCount = 0;
-            unreadCountDisplay = 'inline';
-            action = 'messages_markunread';
-        } else {
-            currentClass = 'unread';
-            newClass = 'read';
-            unreadCount = 0;
-            inboxCount = 1;
-            unreadCountDisplay = 'none';
-            action = 'messages_markread';
-        }
-
-        checkboxes.each( function(i) {
-            if(jq(this).is(':checked')) {
-                if ( jq('#m-' + jq(this).attr('value')).hasClass(currentClass) ) {
-                    checkboxes_tosend += jq(this).attr('value');
-                    jq('#m-' + jq(this).attr('value')).removeClass(currentClass);
-                    jq('#m-' + jq(this).attr('value')).addClass(newClass);
-                    thread_count = jq('#m-' + jq(this).attr('value') + ' td span.unread-count').html();
-
-                    jq('#m-' + jq(this).attr('value') + ' td span.unread-count').html(unreadCount);
-                    jq('#m-' + jq(this).attr('value') + ' td span.unread-count').css('display', unreadCountDisplay);
-
-                    inboxcount = jq('tr.unread').length;
-
-                    jq('#user-messages span').html( inboxcount );
-
-                    if ( i !== checkboxes.length - 1 ) {
-                        checkboxes_tosend += ',';
-                    }
-                }
-            }
-        });
-        jq.post( ajaxurl, {
-            action: action,
-            'thread_ids': checkboxes_tosend
-        });
-        return false;
-    });
-
     /* Selecting unread and read messages in inbox */
     jq( 'body.messages #item-body div.messages' ).on( 'change', '#message-type-select', function() {
@@ -1566 +1517 @@
             checkboxes[i].checked = checked_value;
         });
-    });
-
-    /* Bulk delete messages */
-    jq( 'body.messages #item-body div.messages' ).on( 'click', '.messages-options-nav a', function() {
-        if ( -1 === jq.inArray( this.id, Array( 'delete_sentbox_messages', 'delete_inbox_messages' ) ) ) {
-            return;
-        }
-
-        checkboxes_tosend = '';
-        checkboxes = jq('#message-threads tr td input[type="checkbox"]');
-
-        jq('#message').remove();
-        jq(this).addClass('loading');
-
-        jq(checkboxes).each( function(i) {
-            if( jq(this).is(':checked') ) {
-                checkboxes_tosend += jq(this).attr('value') + ',';
-            }
-        });
-
-        if ( '' === checkboxes_tosend ) {
-            jq(this).removeClass('loading');
-            return false;
-        }
-
-        jq.post( ajaxurl, {
-            action: 'messages_delete',
-            'thread_ids': checkboxes_tosend
-        }, function(response) {
-            if ( response[0] + response[1] === '-1' ) {
-                jq('#message-threads').prepend( response.substr( 2, response.length ) );
-            } else {
-                jq('#message-threads').before( '<div id="message" class="updated"><p>' + response + '</p></div>' );
-
-                jq(checkboxes).each( function(i) {
-                    if( jq(this).is(':checked') ) {
-                        // We need to uncheck because message is only hidden
-                        // Otherwise, AJAX will be fired again with same data
-                        jq(this).attr( 'checked', false );
-                        jq(this).parent().parent().fadeOut(150);
-                    }
-                });
-            }
-
-            jq('#message').hide().slideDown(150);
-            jq('#delete_inbox_messages, #delete_sentbox_messages').removeClass('loading');
-        });
-
-        return false;
     });
 
@@ -1744 +1646 @@
         jq.post( ajaxurl, {
             action: 'messages_close_notice',
-            'notice_id': jq('.notice').attr('rel').substr( 2, jq('.notice').attr('rel').length )
+            'notice_id': jq('.notice').attr('rel').substr( 2, jq('.notice').attr('rel').length ),
+            nonce: jq( '#close-notice-nonce' ).val()
         },
         function(response) {
@@ -2151 +2054 @@
     return encodeURIComponent( jq.param(bpCookies) );
 }
+
+/**
+ * Get a querystring parameter from a URL.
+ *
+ * @param {String} Query string parameter name.
+ * @param {String} URL to parse. Defaults to current URL.
+ */
+function bp_get_query_var( param, url ) {
+    var qs = {};
+
+    // Use current URL if no URL passed.
+    if ( typeof url === 'undefined' ) {
+        url = location.search.substr(1).split('&');
+    } else {
+        url = url.split('?')[1].split('&');
+    }
+
+    // Parse querystring into object props.
+    // http://stackoverflow.com/a/21152762
+    url.forEach(function(item) {
+        qs[item.split("=")[0]] = item.split("=")[1] && decodeURIComponent( item.split("=")[1] );
+    });
+
+    if ( qs.hasOwnProperty( param ) && qs[param] != null ) {
+        return qs[param];
+    } else {
+        return false;
+    }
+}