Changeset 11889 for trunk/src/bp-templates/bp-legacy/buddypress-functions.php

Timestamp:

03/05/2018 01:03:06 PM (7 years ago)

Author:

boonebgorges

Message:

Templates: Die from AJAX friend operations when friend ID is invalid.

This prevents the adding of friendship objects attached to non-existent
users.

Props modemlooper.
Fixes #7683.

File:

• trunk/src/bp-templates/bp-legacy/buddypress-functions.php (modified) (1 diff)

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -1396 +1396 @@
     $friend_id = (int) $_POST['fid'];
 
+    $user = get_user_by( 'id', $friend_id );
+    if ( ! $user ) {
+        die( __( 'No member found by that ID.', 'buddypress' ) );
+    }
+
     // Trying to cancel friendship.
     if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {