Changeset 12371 for trunk/src/bp-templates/bp-nouveau/includes/activity/ajax.php

Timestamp:

04/25/2019 02:24:26 PM (7 years ago)

Author:

boonebgorges

Message:

Activity: Improved capability checks when processing reply POSTs.

File:

• trunk/src/bp-templates/bp-nouveau/includes/activity/ajax.php (modified) (1 diff)

trunk/src/bp-templates/bp-nouveau/includes/activity/ajax.php

@@ -358 +358 @@
 
     if ( empty( $_POST['form_id'] ) || empty( $_POST['comment_id'] ) || ! is_numeric( $_POST['form_id'] ) || ! is_numeric( $_POST['comment_id'] ) ) {
+        wp_send_json_error( $response );
+    }
+
+    $activity_id   = (int) $_POST['form_id'];
+    $activity_item = new BP_Activity_Activity( $activity_id );
+    if ( ! bp_activity_user_can_read( $activity_item ) ) {
         wp_send_json_error( $response );
     }