Changeset 11889

Timestamp:

03/05/2018 01:03:06 PM (8 years ago)

Author:

boonebgorges

Message:

Templates: Die from AJAX friend operations when friend ID is invalid.

This prevents the adding of friendship objects attached to non-existent
users.

Props modemlooper.
Fixes #7683.

Location:

trunk/src/bp-templates

Files:

• bp-legacy/buddypress-functions.php (modified) (1 diff)
• bp-nouveau/includes/friends/ajax.php (modified) (1 diff)

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -1396 +1396 @@
         $friend_id = (int) $_POST['fid'];
 
+        $user = get_user_by( 'id', $friend_id );
+        if ( ! $user ) {
+                die( __( 'No member found by that ID.', 'buddypress' ) );
+        }
+
         // Trying to cancel friendship.
         if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {

trunk/src/bp-templates/bp-nouveau/includes/friends/ajax.php

@@ -89 +89 @@
         $friend_id = (int) $_POST['item_id'];
 
+        $user = get_user_by( 'id', $friend_id );
+        if ( ! $user ) {
+                wp_send_json_error(
+                        array(
+                                'feedback' => sprintf(
+                                        '<div class="bp-feedback error">%s</div>',
+                                        esc_html__( 'No member found by that ID.', 'buddypress' )
+                                ),
+                        )
+                );
+        }
+
         // In the 2 first cases the $friend_id is a friendship id.
         if ( ! empty( $_POST['action'] ) && 'friends_accept_friendship' === $_POST['action'] ) {