Skip to:
Content

BuddyPress.org

Opened 15 years ago

Closed 15 years ago

#3211 closed defect (bug) (fixed)

Activity permalink screen doesn't check the author of the activity update

Reported by: r-a-y Owned by: DJPaul
Priority: normal Milestone: 1.5
Component: Activity Version: 1.5
Severity: Keywords: has-patch
Cc:

Description

The default activity permalink looks like:
​http://testbp.org/activity/p/99923/

BP's activity router redirects this to:
​http://testbp.org/members/johnjamesjacoby/activity/99923

However, no check is done on the author (in this case "johnjamesjacoby"), so I can do this:
​http://testbp.org/members/ANYTHINGHERE/activity/99923

And it will still work.

Attached patch fixes this.

Attachments (1)

3211.01.patch​ (528 bytes ) - added by r-a-y 15 years ago.

Download all attachments as: .zip

Change History (7)

@r-a-y
15 years ago

#1 @Dennissmolek
15 years ago

The weird stuff yall find blows my mind..

#2 @DJPaul
15 years ago

  • Milestone Awaiting Review → 1.3

This needs to be addressed with #3176.

#3 @r-a-y
15 years ago

See my comment in #3176.

This ticket stands alone.

#4 @DJPaul
15 years ago

If the URL is wrong, the URL is wrong and should 404, not redirect silently to the home page. Master ticket for the redirect issue is #3280

#5 @DJPaul
15 years ago

  • Owner set to DJPaul
  • Status new → accepted

#6 @DJPaul
15 years ago

  • Resolution → fixed
  • Status accepted → closed

Good news, everyone! This was fixed in r4506

Note: See TracTickets for help on using tickets.