Changeset 11450 for branches/2.8/src/bp-templates/bp-legacy/buddypress-functions.php

Timestamp:

03/08/2017 04:46:28 PM (10 years ago)

Author:

boonebgorges

Message:

Improved nonce protection for some front-end AJAX endpoints.

Merge of [11449] to the 2.8 branch.

Location:

branches/2.8

Files:

• . (modified) (1 prop)
• src/bp-templates/bp-legacy/buddypress-functions.php (modified) (7 diffs)

branches/2.8/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -874 +874 @@
                 case 'mentions':
                         $feed_url = bp_loggedin_user_domain() . bp_get_activity_slug() . '/mentions/feed/';
-                        bp_activity_clear_new_mentions( bp_loggedin_user_id() );
+
+                        if ( isset( $_POST['_wpnonce_activity_filter'] ) && wp_verify_nonce( wp_unslash( $_POST['_wpnonce_activity_filter'] ), 'activity_filter' ) ) {
+                                bp_activity_clear_new_mentions( bp_loggedin_user_id() );
+                        }
+
                         break;
                 default:
@@ -1195 +1199 @@
                 return;
 
+        if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( wp_unslash( $_POST['nonce'] ), 'mark_favorite' ) ) {
+                return;
+        }
+
         if ( bp_activity_add_user_favorite( $_POST['id'] ) )
                 _e( 'Remove Favorite', 'buddypress' );
@@ -1214 +1222 @@
         if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
                 return;
+
+        if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( wp_unslash( $_POST['nonce'] ), 'unmark_favorite' ) ) {
+                return;
+        }
 
         if ( bp_activity_remove_user_favorite( $_POST['id'] ) )
@@ -1524 +1536 @@
                 return;
 
-        if ( ! isset( $_POST['notice_id'] ) ) {
+        $nonce_check = isset( $_POST['nonce'] ) && wp_verify_nonce( wp_unslash( $_POST['nonce'] ), 'bp_messages_close_notice' );
+
+        if ( ! $nonce_check || ! isset( $_POST['notice_id'] ) ) {
                 echo "-1<div id='message' class='error'><p>" . __( 'There was a problem closing the notice.', 'buddypress' ) . '</p></div>';
 
@@ -1601 +1615 @@
  * Mark a private message as unread in your inbox via a POST request.
  *
+ * No longer used.
+ *
  * @since 1.2.0
+ * @deprecated 2.2.0
  *
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_ajax_message_markunread() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
-                return;
-
-        if ( ! isset($_POST['thread_ids']) ) {
-                echo "-1<div id='message' class='error'><p>" . __( 'There was a problem marking messages as unread.', 'buddypress' ) . '</p></div>';
-
-        } else {
-                $thread_ids = explode( ',', $_POST['thread_ids'] );
-
-                for ( $i = 0, $count = count( $thread_ids ); $i < $count; ++$i ) {
-                        BP_Messages_Thread::mark_as_unread( (int) $thread_ids[$i] );
-                }
-        }
-
-        exit;
+        die( '-1' );
 }
 
@@ -1627 +1629 @@
  * Mark a private message as read in your inbox via a POST request.
  *
+ * No longer used.
+ *
  * @since 1.2.0
+ * @deprecated 2.2.0
  *
  * @return mixed String on error, void on success.
  */
 function bp_legacy_theme_ajax_message_markread() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
-                return;
-
-        if ( ! isset($_POST['thread_ids']) ) {
-                echo "-1<div id='message' class='error'><p>" . __('There was a problem marking messages as read.', 'buddypress' ) . '</p></div>';
-
-        } else {
-                $thread_ids = explode( ',', $_POST['thread_ids'] );
-
-                for ( $i = 0, $count = count( $thread_ids ); $i < $count; ++$i ) {
-                        BP_Messages_Thread::mark_as_read( (int) $thread_ids[$i] );
-                }
-        }
-
-        exit;
+        die( '-1' );
 }
 
@@ -1653 +1643 @@
  * Delete a private message(s) in your inbox via a POST request.
  *
+ * No longer used.
+ *
  * @since 1.2.0
+ * @deprecated 2.2.0
  *
  * @return string HTML
  */
 function bp_legacy_theme_ajax_messages_delete() {
-        // Bail if not a POST action.
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
-                return;
-
-        if ( ! isset($_POST['thread_ids']) ) {
-                echo "-1<div id='message' class='error'><p>" . __( 'There was a problem deleting messages.', 'buddypress' ) . '</p></div>';
-
-        } else {
-                $thread_ids = wp_parse_id_list( $_POST['thread_ids'] );
-                messages_delete_thread( $thread_ids );
-
-                _e( 'Messages deleted.', 'buddypress' );
-        }
-
-        exit;
+        die( '-1' );
 }