Fetching of ALL users from bp_friends_prime_mentions_results() for non logged in users

[dsar]

Hello,

Currently, bp_friends_prime_mentions_results()'s only check if a user is not logged in is dependent on Wordpress filter (bp_activity_maybe_load_mentions_scripts). When another plugin sets high priority for this filter and returns true, as is the case currently with rtMedia ​https://github.com/rtMediaWP/rtMedia/blob/d9d060dc59fe0a153df57e2dd7e062ad5c6721e9/app/main/RTMedia.php#L220-L236
bp_friends_prime_mentions_results() will run completely even for non logged in users.
This results in listing of ALL users on all pages for non-logged in users.

This is a huge issue, and although it's initiated by rtMEdia's code, I believe Buddypress should have a check to avoid this problem. It's as easy as adding

if (get_current_user_id() == 0) {
      return;
}

check to bp_friends_prime_mentions_results().

Maybe a better, or additional fix would be to change how BP_User_Query class works - currently passing user_id 0 to it will return all users. I think it should return no users. This would be doable by changing default user_id in it to null or false and having a proper check for it. Currently, default for user_id is 0 and check if user_id is passed is using empty().

[bhargavbhandari90]

Hi @dsar,

I have a second thought on this.

<?php
// Stop here if user is not logged in.
if ( ! is_user_logged_in() ) {
    return;
}

This above code will also do the same thing.

[bhargavbhandari90]

Here is the patch. Check this and let us know.

[dsar]

Hi @bhargavbhandari90,

That's even better, thank you!

What do you think about my suggestion for changing of how BP_User_Query class works? I really think this is a bug as well, as documentation states:

user_id (optional)
Pass a single numeric user id to limit results to friends of that user. Requires the Friends component.
Default value: 0

which doesn't really happen if passed user_id is 0. In that case, all users are returned.

[r-a-y]

@bhargavbhandari90 's patch looks good.

We'll commit that for v2.9.

As for @dsar 's question about user_id = 0, I don't think we should change the default value, otherwise some plugins expecting the user_id to be 0 will no longer work. Will need some other feedback from other devs if we want to change this behavior.

[bhargavbhandari90]

@r-a-y I agreed.

And yes, we need some other feedback.

[r-a-y]

In 11561:

Friends: Do not prime mention results if user is not logged in.

Props bhargavbhandari90.

Fixes #7530.