Changeset 13042

Timestamp:

08/13/2021 12:21:11 PM (5 years ago)

Author:

imath

Message:

Activity: update the nonce used by the Activity Reply JS Fallback

If JavaScript is unavailable (whether it was disabled or it errored), posting an activity uses the bp_activity_action_post_comment() PHP function after a page load. Unlike the Ajax action, the nonce used into this function has not been updated in [12735]. The main goal of this commit is to fix this oversight. The secondary goal is to improve code formatting.

Fixes #8545 (branch 9.0)

File:

• branches/9.0/src/bp-activity/actions/reply.php (modified) (3 diffs)

branches/9.0/src/bp-activity/actions/reply.php

@@ -16 +16 @@
  */
 function bp_activity_action_post_comment() {
-        if ( !is_user_logged_in() || !bp_is_activity_component() || !bp_is_current_action( 'reply' ) )
+        if ( ! is_user_logged_in() || ! bp_is_activity_component() || ! bp_is_current_action( 'reply' ) ) {
                 return false;
+        }
+
+        if ( ! isset( $_POST['comment_form_id'] ) ) {
+                return false;
+        }
+
+        $activity_id = absint( wp_unslash( $_POST['comment_form_id'] ) );
+
+        if ( ! isset( $activity_id ) ) {
+                return false;
+        }
 
         // Check the nonce.
-        check_admin_referer( 'new_activity_comment', '_wpnonce_new_activity_comment' );
+        check_admin_referer( 'new_activity_comment', '_wpnonce_new_activity_comment_' . $activity_id );
 
         /**
@@ -27 +38 @@
          * @since 1.2.0
          *
-         * @param string $value ID of the activity being replied to.
+         * @param string $activity_id ID of the activity being replied to.
          */
-        $activity_id = apply_filters( 'bp_activity_post_comment_activity_id', $_POST['comment_form_id'] );
+        $activity_id = apply_filters( 'bp_activity_post_comment_activity_id', $activity_id );
 
         /**
@@ -51 +62 @@
         }
 
-        $comment_id = bp_activity_new_comment( array(
-                'content'     => $content,
-                'activity_id' => $activity_id,
-                'parent_id'   => false
-        ));
+        $comment_id = bp_activity_new_comment(
+                array(
+                        'content'     => $content,
+                        'activity_id' => $activity_id,
+                        'parent_id'   => false
+                )
+        );
 
-        if ( !empty( $comment_id ) )
+        if ( ! empty( $comment_id ) ) {
                 bp_core_add_message( __( 'Reply Posted!', 'buddypress' ) );
-        else
+        } else {
                 bp_core_add_message( __( 'There was an error posting that reply. Please try again.', 'buddypress' ), 'error' );
+        }
 
         bp_core_redirect( wp_get_referer() . '#ac-form-' . $activity_id );