Changeset 12735

Timestamp:

09/25/2020 07:15:20 PM (4 years ago)

Author:

imath

Message:

Templates: avoid duplicate IDs into comment form nonce field

We now include the Activity ID to the id attribute of the input tag generated for the nonce field used into the Activity comment form. This makes sure to avoid duplicate IDs when multiple activities are displayed on the activity pages.

Props dcavins

Fixes #8004

Location:

trunk/src/bp-templates

Files:

• bp-legacy/buddypress/activity/entry.php (modified) (1 diff)
• bp-legacy/js/buddypress.js (modified) (1 diff)
• bp-nouveau/buddypress/activity/comment-form.php (modified) (1 diff)
• bp-nouveau/includes/template-tags.php (modified) (2 diffs)
• bp-nouveau/js/buddypress-activity.js (modified) (2 diffs)

trunk/src/bp-templates/bp-legacy/buddypress/activity/entry.php

@@ -146 +146 @@
                     do_action( 'bp_activity_entry_comments' ); ?>
 
-                    <?php wp_nonce_field( 'new_activity_comment', '_wpnonce_new_activity_comment' ); ?>
+                    <?php wp_nonce_field( 'new_activity_comment', '_wpnonce_new_activity_comment_' . bp_get_activity_id() ); ?>
 
                 </form>

trunk/src/bp-templates/bp-legacy/js/buddypress.js

@@ -611 +611 @@
                 action: 'new_activity_comment',
                 'cookie': bp_get_cookies(),
-                '_wpnonce_new_activity_comment': jq('#_wpnonce_new_activity_comment').val(),
+                '_wpnonce_new_activity_comment': jq('#_wpnonce_new_activity_comment' + '_' + comment_id ).val(),
                 'comment_id': comment_id,
                 'form_id': form_id[2],

trunk/src/bp-templates/bp-nouveau/buddypress/activity/comment-form.php

@@ -24 +24 @@
 
         <?php
-        bp_nouveau_submit_button( 'activity-new-comment' );
+        bp_nouveau_submit_button( 'activity-new-comment', bp_get_activity_id() );
         printf(
             '&nbsp; <button type="button" class="ac-reply-cancel">%s</button>',

trunk/src/bp-templates/bp-nouveau/includes/template-tags.php

@@ -2586 +2586 @@
  * @param string $action The action to get the submit button for. Required.
  */
-function bp_nouveau_submit_button( $action ) {
+function bp_nouveau_submit_button( $action, $object_id = 0 ) {
     $submit_data = bp_nouveau_get_submit_button( $action );
     if ( empty( $submit_data['attributes'] ) || empty( $submit_data['nonce'] ) ) {
@@ -2620 +2620 @@
         wp_nonce_field( $submit_data['nonce'] );
     } else {
+        if ( $object_id ) {
+            $submit_data['nonce_key'] .= '_' . (int) $object_id;
+        }
+
         wp_nonce_field( $submit_data['nonce'], $submit_data['nonce_key'] );
     }

trunk/src/bp-templates/bp-nouveau/js/buddypress-activity.js

@@ -1 +1 @@
 /* jshint browser: true */
 /* global bp, BP_Nouveau */
-/* @version 3.1.0 */
+/* @since 3.0.0 */
+/* @version 7.0.0 */
 window.bp = window.bp || {};
 
@@ -736 +737 @@
                 comment_data = {
                     action                        : 'new_activity_comment',
-                    _wpnonce_new_activity_comment : $( '#_wpnonce_new_activity_comment' ).val(),
+                    _wpnonce_new_activity_comment : $( '#_wpnonce_new_activity_comment' + '_' + item_id ).val(),
                     comment_id                    : item_id,
                     form_id                       : activity_id,