Changeset 9948 for trunk/src/bp-messages/bp-messages-filters.php

Timestamp:

06/16/2015 10:48:11 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Messages: Introduce filter to enforce private message thread query boundaries.

This change ensures that all queries for private messages will always return anticipated results, even when certain malformed values are passed in. It specifically hardens the user ID argument to prevent accidental overriding.

Fixes #6504. Props r-a-y. (trunk, for 2.4.0)

File:

• trunk/src/bp-messages/bp-messages-filters.php (modified) (1 diff)

trunk/src/bp-messages/bp-messages-filters.php

@@ -66 +66 @@
 add_filter( 'bp_get_the_thread_message_content', 'stripslashes_deep' );
 add_filter( 'bp_get_the_thread_subject',         'stripslashes_deep' );
+
+/**
+ * Enforce limitations on viewing private message contents
+ *
+ * @since BuddyPress (2.3.2)
+ *
+ * @see bp_has_message_threads() for description of parameters
+ *
+ * @param array|string $args See {@link bp_has_message_threads()}.
+ */
+function bp_messages_enforce_current_user( $args = array() ) {
+
+    // Non-community moderators can only ever see their own messages
+    if ( is_user_logged_in() && ! bp_current_user_can( 'bp_moderate' ) ) {
+        $_user_id = (int) bp_loggedin_user_id();
+        if ( $_user_id !== (int) $args['user_id'] ) {
+            $args['user_id'] = $_user_id;
+        }
+    }
+
+    // Return possibly modified $args array
+    return $args;
+}
+add_filter( 'bp_after_has_message_threads_parse_args', 'bp_messages_enforce_current_user', 5 );