Changeset 5908

Timestamp:

03/13/2012 08:33:06 PM (13 years ago)

Author:

johnjamesjacoby

Message:

Bail early in bp-default ajax functions if not a POST request.

File:

• trunk/bp-themes/bp-default/_inc/ajax.php (modified) (21 diffs)

trunk/bp-themes/bp-default/_inc/ajax.php

@@ -86 +86 @@
 function bp_dtheme_object_template_loader() {
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     /**
      * AJAX requests happen too early to be seen by bp_update_is_directory()
@@ -117 +121 @@
 // This function will load the activity loop template when activity is requested via AJAX
 function bp_dtheme_activity_template_loader() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     $scope = '';
@@ -157 +165 @@
 function bp_dtheme_post_update() {
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     // Check the nonce
     check_admin_referer( 'post_update', '_wpnonce_post_update' );
@@ -197 +209 @@
 /* AJAX activity comment posting */
 function bp_dtheme_new_activity_comment() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     // Check the nonce
@@ -254 +270 @@
 function bp_dtheme_delete_activity() {
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     // Check the nonce
     check_admin_referer( 'bp_activity_delete_link' );
@@ -291 +311 @@
 /* AJAX delete an activity comment */
 function bp_dtheme_delete_activity_comment() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     // Check the nonce
@@ -332 +356 @@
     global $bp;
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     // Check that user is logged in, Activity Streams are enabled, and Akismet is present.
     if ( !is_user_logged_in() || !bp_is_active( 'activity' ) || empty( $bp->activity->akismet ) ) {
@@ -374 +402 @@
 function bp_dtheme_mark_activity_favorite() {
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     bp_activity_add_user_favorite( $_POST['id'] );
     _e( 'Remove Favorite', 'buddypress' );
@@ -381 +413 @@
 /* AJAX mark an activity as not a favorite */
 function bp_dtheme_unmark_activity_favorite() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     bp_activity_remove_user_favorite( $_POST['id'] );
@@ -394 +430 @@
  */
 function bp_dtheme_get_single_activity_content() {
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     $activity_array = bp_activity_get_specific( array(
         'activity_ids'     => $_POST['activity_id'],
@@ -401 +441 @@
     $activity = !empty( $activity_array['activities'][0] ) ? $activity_array['activities'][0] : false;
 
-    if ( !$activity )
+    if ( empty( $activity ) )
         exit(); // todo: error?
 
@@ -417 +457 @@
 /* AJAX invite a friend to a group functionality */
 function bp_dtheme_ajax_invite_user() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     check_ajax_referer( 'groups_invite_uninvite_user' );
@@ -461 +505 @@
 function bp_dtheme_ajax_addremove_friend() {
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $_POST['fid'] ) ) {
 
@@ -490 +538 @@
 /* AJAX accept a user as a friend when clicking the "accept" button */
 function bp_dtheme_ajax_accept_friendship() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     check_admin_referer( 'friends_accept_friendship' );
 
@@ -501 +554 @@
 /* AJAX reject a user as a friend when clicking the "reject" button */
 function bp_dtheme_ajax_reject_friendship() {
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     check_admin_referer( 'friends_reject_friendship' );
 
@@ -512 +569 @@
 /* AJAX join or leave a group when clicking the "join/leave" button */
 function bp_dtheme_ajax_joinleave_group() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     if ( groups_is_user_banned( bp_loggedin_user_id(), $_POST['gid'] ) )
@@ -563 +624 @@
     global $userdata;
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     if ( !isset( $_POST['notice_id'] ) ) {
         echo "-1<div id='message' class='error'><p>" . __('There was a problem closing the notice.', 'buddypress') . '</p></div>';
@@ -578 +643 @@
 function bp_dtheme_ajax_messages_send_reply() {
     global $bp;
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     check_ajax_referer( 'messages_send_message' );
@@ -614 +683 @@
 function bp_dtheme_ajax_message_markunread() {
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     if ( !isset($_POST['thread_ids']) ) {
         echo "-1<div id='message' class='error'><p>" . __('There was a problem marking messages as unread.', 'buddypress' ) . '</p></div>';
@@ -629 +702 @@
 function bp_dtheme_ajax_message_markread() {
 
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
+
     if ( !isset($_POST['thread_ids']) ) {
         echo "-1<div id='message' class='error'><p>" . __('There was a problem marking messages as read.', 'buddypress' ) . '</p></div>';
@@ -643 +720 @@
 /* AJAX delete a private message or array of messages in your inbox */
 function bp_dtheme_ajax_messages_delete() {
+
+    // Bail if not a POST action
+    if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+        return;
 
     if ( !isset($_POST['thread_ids']) ) {