Changeset 6739 for trunk/bp-templates/bp-legacy/buddypress-functions.php

Timestamp:

01/22/2013 07:19:12 PM (14 years ago)

Author:

johnjamesjacoby

Message:

Better friend ID handling in ajax add/remove friend handler in bp-default and bp-legacy. Props Maty.

File:

• trunk/bp-templates/bp-legacy/buddypress-functions.php (modified) (1 diff)

trunk/bp-templates/bp-legacy/buddypress-functions.php

@@ -838 +838 @@
  */
 function bp_legacy_theme_ajax_addremove_friend() {
-        // Bail if not a POST action
-        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
-                return;
-
-        if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $_POST['fid'] ) ) {
+
+        // Bail if not a POST action
+        if ( 'POST' !== strtoupper( $_SERVER['REQUEST_METHOD'] ) )
+                return;
+
+        // Cast fid as an integer
+        $friend_id = (int) $_POST['fid'];
+
+        // Trying to cancel friendship
+        if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {
                 check_ajax_referer( 'friends_remove_friend' );
 
-                if ( ! friends_remove_friend( bp_loggedin_user_id(), $_POST['fid'] ) )
+                if ( ! friends_remove_friend( bp_loggedin_user_id(), $friend_id ) ) {
                         echo __( 'Friendship could not be canceled.', 'buddypress' );
-                else
-                        echo '<a id="friend-' . $_POST['fid'] . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . wp_nonce_url( bp_loggedin_user_domain() . bp_get_friends_slug() . '/add-friend/' . $_POST['fid'], 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
-
-        } elseif ( 'not_friends' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $_POST['fid'] ) ) {
+                } else {
+                        echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . wp_nonce_url( bp_loggedin_user_domain() . bp_get_friends_slug() . '/add-friend/' . $friend_id, 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
+                }
+
+        // Trying to request friendship
+        } elseif ( 'not_friends' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {
                 check_ajax_referer( 'friends_add_friend' );
 
-                if ( ! friends_add_friend( bp_loggedin_user_id(), $_POST['fid'] ) )
+                if ( ! friends_add_friend( bp_loggedin_user_id(), $friend_id ) ) {
                         echo __(' Friendship could not be requested.', 'buddypress' );
-                else
-                        echo '<a id="friend-' . $_POST['fid'] . '" class="remove" rel="remove" title="' . __( 'Cancel Friendship Request', 'buddypress' ) . '" href="' . wp_nonce_url( bp_loggedin_user_domain() . bp_get_friends_slug() . '/requests/cancel/' . (int) $_POST['fid'] . '/', 'friends_withdraw_friendship' ) . '" class="requested">' . __( 'Cancel Friendship Request', 'buddypress' ) . '</a>';
-
-        } elseif ( 'pending' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), (int) $_POST['fid'] ) ) {
+                } else {
+                        echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="remove" rel="remove" title="' . __( 'Cancel Friendship Request', 'buddypress' ) . '" href="' . wp_nonce_url( bp_loggedin_user_domain() . bp_get_friends_slug() . '/requests/cancel/' . $friend_id . '/', 'friends_withdraw_friendship' ) . '" class="requested">' . __( 'Cancel Friendship Request', 'buddypress' ) . '</a>';
+                }
+
+        // Trying to cancel pending request
+        } elseif ( 'pending' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {
                 check_ajax_referer( 'friends_withdraw_friendship' );
 
-                if ( friends_withdraw_friendship( bp_loggedin_user_id(), (int) $_POST['fid'] ) )
-                        echo '<a id="friend-' . $_POST['fid'] . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . wp_nonce_url( bp_loggedin_user_domain() . bp_get_friends_slug() . '/add-friend/' . $_POST['fid'], 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
-                else
+                if ( friends_withdraw_friendship( bp_loggedin_user_id(), $friend_id ) ) {
+                        echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="add" rel="add" title="' . __( 'Add Friend', 'buddypress' ) . '" href="' . wp_nonce_url( bp_loggedin_user_domain() . bp_get_friends_slug() . '/add-friend/' . $friend_id, 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
+                } else {
                         echo __("Friendship request could not be cancelled.", 'buddypress');
-
+                }
+
+        // Request already pending
         } else {
                 echo __( 'Request Pending', 'buddypress' );