Skip to:
Content

BuddyPress.org

Changeset 12402


Ignore:
Timestamp:
06/17/2019 05:41:01 PM (6 months ago)
Author:
imath
Message:

Make sure Messages exports only include the ones sent by the user

Using the $user->ID instead of the $recipients->ID to check for the sender ID is more reliable to make sure the generated zip Archive only contains messages sent by the requesting user.

Props gingerbooch, Venutius

See #8080 (branch 4.0)

Location:
branches/4.0
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.0/src/bp-messages/bp-messages-functions.php

    r12180 r12402  
    685685        foreach ( $thread->messages as $message_index => $message ) {
    686686            // Only include messages written by the user.
    687             if ( $recipient->user_id !== $message->sender_id ) {
     687            if ( $user->ID !== $message->sender_id ) {
    688688                continue;
    689689            }
  • branches/4.0/tests/phpunit/testcases/messages/functions.php

    r12164 r12402  
    153153        $this->assertSame( 3, count( $actual['data'] ) );
    154154    }
     155
     156    /**
     157     * @ticket BP8080
     158     */
     159    public function test_bp_messages_personal_data_exporter_check_sender() {
     160        $u1       = self::factory()->user->create();
     161        $u2       = self::factory()->user->create();
     162        $expected = array(
     163            'Hey u2!',
     164            'You could have replied to my first message u2!',
     165        );
     166
     167        $time = time();
     168
     169        $t1 = messages_new_message( array(
     170            'sender_id'  => $u1,
     171            'recipients' => array( $u2 ),
     172            'subject'    => 'A new message',
     173            'content'    => $expected[0],
     174            'date_sent'  => date( 'Y-m-d H:i:s', $time - ( 3 * HOUR_IN_SECONDS ) ),
     175        ) );
     176
     177        $t2 = messages_new_message( array(
     178            'sender_id'  => $u2,
     179            'recipients' => array( $u1 ),
     180            'subject'    => 'A new message',
     181            'content'    => 'Hey u1!',
     182            'date_sent'  => date( 'Y-m-d H:i:s', $time - ( 5 * HOUR_IN_SECONDS ) ),
     183        ) );
     184
     185        $t3 = messages_new_message( array(
     186            'sender_id'  => $u1,
     187            'thread_id'  => $t2,
     188            'recipients' => array( $u2 ),
     189            'subject'    => 'Reply to ' . $t2,
     190            'content'    => $expected[1],
     191            'date_sent'  => date( 'Y-m-d H:i:s', $time - ( 4 * HOUR_IN_SECONDS ) ),
     192        ) );
     193
     194        $test_user = new WP_User( $u1 );
     195
     196        $threads      = bp_messages_personal_data_exporter( $test_user->user_email, 1 );
     197        $threads_data = wp_list_pluck( $threads['data'], 'data' );
     198        $actual       = array();
     199
     200        foreach ( $threads_data as $thread ) {
     201            foreach ( $thread as $data ) {
     202                if ( 'Message Content' !== $data['name'] ) {
     203                    continue;
     204                }
     205
     206                $actual[] = $data['value'];
     207            }
     208        }
     209
     210        // Only messages sent by u1 should be exported.
     211        $this->assertEquals( $expected, $actual );
     212    }
    155213}
Note: See TracChangeset for help on using the changeset viewer.