Changeset 14107 for branches/12.0/src/bp-notifications/actions/bulk-manage.php

Timestamp:

03/20/2025 07:10:28 PM (11 months ago)

Author:

dcavins

Message:

Restrict bulk notification management to owner (14.0 branch).

When attempting to manage notifications in bulk, ensure that the current user is either a site admin or owns all of the notifications specified.

Many thanks to Brian Mungah for responsibly reporting the problem.

File:

• branches/12.0/src/bp-notifications/actions/bulk-manage.php (modified) (1 diff)

branches/12.0/src/bp-notifications/actions/bulk-manage.php

@@ -41 +41 @@
 
     // Delete, mark as read or unread depending on the user 'action'.
+    $result = bp_notifications_bulk_manage_notifications( $action, $notifications );
+
+    // Set message depending on the user 'action'.
     switch ( $action ) {
         case 'delete':
-            bp_notifications_delete_notifications_by_ids( $notifications );
             bp_core_add_message( __( 'Notifications deleted.', 'buddypress' ) );
             break;
 
         case 'read':
-            bp_notifications_mark_notifications_by_ids( $notifications, false );
             bp_core_add_message( __( 'Notifications marked as read', 'buddypress' ) );
             break;
 
         case 'unread':
-            bp_notifications_mark_notifications_by_ids( $notifications, true );
             bp_core_add_message( __( 'Notifications marked as unread.', 'buddypress' ) );
             break;