BP User Query and management of the include argument

[imath]

Hi,

I think this trouble is really annoying, that's why, for the first time, i've put a high severity on a ticket.

I was testing the friends component, then i've noticed when going into my friendship requests page (siteurl.dev/members/imath/friends/requests/) that all the users of the blog where showing even if i hadn't ask them to become my friends. So i clicked on Accept friendship to see what would happened but as no user id is in the url, it triggers an error...

Then i added a friend and went on his request page and there i was the only one in his request list. So i accepted and as soon as i've reloaded the request page, all the users were showing again. Even the friend i've accepted, and the button Accept was back..

So i've searched and landed in BP_User_Query class where the include parameter of bp_has_members() is managed, and the problem seems to be there as with the use of !empty( $include ) at line 318 of bp-core-classes.php the $sqlwhere?[] = 'u.user_id IN (0)' is never set. So the $sqlwhere? only have 1 element : 'u.field_id = 1' and all the users are showing.

I've checked in 1.7 and saw that the condition was false !== $include, so the diff attached to this ticket is using this condition and it seems to solve the trouble in the member's request friendship page. But i don't know if this break something elsewhere, so i think this should be checked more deeply.

[boonebgorges]

I've confirmed this. From what I can see, it only happens when the current user has zero real friendship requests. (In other words, if there is at least one legitimate request, the bp_has_members() and BP_User_Query will return the correct users.)

[trishasalas]

I applied the patch, tried with and without. On a dev install where I have 0 friends and 0 friend requests I am presented with the entire member list before the patch. When the patch is applied it returns 0 as expected.

Will report back if I see any wonky behavior otherwise.

[boonebgorges]

In 7239:

Use strict type checking when setting default 'include' value in BP_User_Query

Using the empty() check resulted in problems when empty arrays were passed into
BP_User_Query as the 'include' parameter, such as when querying for a user's
friend requests when the user did not have any - in these cases, all users
ended up being returned.

Fixes #5071

Props imath