Changeset 13041

Timestamp:

08/13/2021 12:19:58 PM (4 years ago)

Author:

imath

Message:

Activity: update the nonce used by the Activity Reply JS Fallback

If JavaScript is unavailable (whether it was disabled or it errored), posting an activity uses the bp_activity_action_post_comment() PHP function after a page load. Unlike the Ajax action, the nonce used into this function has not been updated in [12735]. The main goal of this commit is to fix this oversight. The secondary goal is to improve code formatting.

See #8545 (trunk)

File:

• trunk/src/bp-activity/actions/reply.php (modified) (3 diffs)

trunk/src/bp-activity/actions/reply.php

@@ -16 +16 @@
  */
 function bp_activity_action_post_comment() {
-    if ( !is_user_logged_in() || !bp_is_activity_component() || !bp_is_current_action( 'reply' ) )
+    if ( ! is_user_logged_in() || ! bp_is_activity_component() || ! bp_is_current_action( 'reply' ) ) {
         return false;
+    }
+
+    if ( ! isset( $_POST['comment_form_id'] ) ) {
+        return false;
+    }
+
+    $activity_id = absint( wp_unslash( $_POST['comment_form_id'] ) );
+
+    if ( ! isset( $activity_id ) ) {
+        return false;
+    }
 
     // Check the nonce.
-    check_admin_referer( 'new_activity_comment', '_wpnonce_new_activity_comment' );
+    check_admin_referer( 'new_activity_comment', '_wpnonce_new_activity_comment_' . $activity_id );
 
     /**
@@ -27 +38 @@
      * @since 1.2.0
      *
-     * @param string $value ID of the activity being replied to.
+     * @param string $activity_id ID of the activity being replied to.
      */
-    $activity_id = apply_filters( 'bp_activity_post_comment_activity_id', $_POST['comment_form_id'] );
+    $activity_id = apply_filters( 'bp_activity_post_comment_activity_id', $activity_id );
 
     /**
@@ -51 +62 @@
     }
 
-    $comment_id = bp_activity_new_comment( array(
-        'content'     => $content,
-        'activity_id' => $activity_id,
-        'parent_id'   => false
-    ));
+    $comment_id = bp_activity_new_comment(
+        array(
+            'content'     => $content,
+            'activity_id' => $activity_id,
+            'parent_id'   => false
+        )
+    );
 
-    if ( !empty( $comment_id ) )
+    if ( ! empty( $comment_id ) ) {
         bp_core_add_message( __( 'Reply Posted!', 'buddypress' ) );
-    else
+    } else {
         bp_core_add_message( __( 'There was an error posting that reply. Please try again.', 'buddypress' ), 'error' );
+    }
 
     bp_core_redirect( wp_get_referer() . '#ac-form-' . $activity_id );