Long cookie value can lead to 414 Long Request Error resulting in AJAX failing

[r-a-y]

Forgot to post this and just remembered.

In bp_dtheme_ajax_querystring(), we grab the entire $_COOKIE value and store it:
​http://buddypress.trac.wordpress.org/browser/tags/1.6.1/bp-themes/bp-default/_inc/ajax.php#L95

What happens is when we run a BP AJAX query, the entire cookie string is passed on as well to wp-load.php. For sites that store many cookies (external scripts, tracking, etc.), this can lead to a 414 Long Request error resulting in AJAX failing.

We should only pass on BP's cookies instead of all the cookies.

[DJPaul]

Not sure this is as simple as that. What about plugins that might use their own cookies, and expect it to be passed by this AJAX request?

[r-a-y]

I think the approach would be okay if plugin developers used the same "bp-" prefix that BP uses for its own cookies and if we only pass on cookies with the "bp-" prefix.

[johnjamesjacoby]

I'm okay restricting this to BuddyPress only cookies. It's likely that third party components would have their own ajax handlers anyhow, given how complex BuddyPress's is.

Patch, or punt.

[r-a-y]

Attached a patch.

Had to do this at the javascript level since the AJAX call relies on it.

I've created a new JS function called bp_get_cookies(), which loops through all available cookies and only passes cookies with the 'bp-' prefix.

Let me know what you guys think!

[r-a-y]

Use local "jq" variable instead of "jQuery"

[DJPaul]

Would rather 1.8-early this so it can get lots of testing.

[r-a-y]

I'm okay with bumping this to 1.8.

[boonebgorges]

The patch looks good to me, but I agree it should get in early so that plugin/theme authors can test against it. r-a-y, I'll leave the honors to you :)

[r-a-y]

In 6940:

Only pass BP-related cookies to BP AJAX queries.

Previously, we would pass all cookies to admin-ajax.php. This could
potentially lead to a '414 Long Request' error because of the length of the
querystring, resulting in the AJAX request failing.

This commit only passes cookies with the 'bp-' prefix to admin-ajax.php,
thus limiting the length of the URI request.

Fixes #4606.

[djpaul]

In 9248:

Messages: update autocomplete script to better handle long cookie values.

See #4606 for previous similiar fixes.

Fixes #5959, props psycleuk