Prevent friend POST request from member to himself

[megainfo]

Member can be a friend with himself by sending ajax post (using some web tools like Firefox Webdeveloper or Firebug).

[megainfo]

Patch for Legacy template

[megainfo]

Patch for default theme

[boonebgorges]

I don't see that much harm can come of this, but I suppose it's a good idea to fix it.

Other devs: better to fix here, or in friends_add_friend()? Any legitimate reason anyone can think of why we'd want to allow self-friendships at the level of friends_add_friend() but not at the interface level?

[r-a-y]

I'd say put the fix in friends_add_friend(). I don't think there's a legitimate reason a person would want to be friends with themselves!

[imath]

I agree with r-a-y.

[boonebgorges]

Sounds good to me. Let's get a refresh on the patch.

[r-a-y]

Attached patch checks if the initiator and the pending friend to see if they are the same. If they are the same, we bail.

Patch also fixes a logic issue with how friends_add_friend() checks if the two users are already friends. We need to use the friends_check_friendship() to actually check if two users are friends or not. Instantiating a new BP_Friends_Friendship object does not do anything.

Just wanted some feedback on the latter before I commit.

[boonebgorges]

IMHO the current behavior of returning *true* when users are already friends is incorrect. It ought to return *false*. But that's an issue for a separate ticket. Fix looks good; I'm going to commit it with unit tests.

[boonebgorges]

In 8172:

Return false friends_add_friend() when the initiator is the same as the friend

It's good to love yourself, but there's no real reason to allow
self-friendships in BuddyPress.

See #5319

Props megainfo, r-a-y

[boonebgorges]

In 8173:

Fix check for existing friendship in friends_add_friend()

The previous logic would always result in this check failing.

Fixes #5319

Props r-a-y