bp_message_notice_delete_link uses wrong action for nonce generation

[tobiashonold]

In the file buddypress/bp-messages/bp-messages-template.php in line 1226 it uses 'messages_delete_thread' as action, but it should be 'messages_delete_notice' or deletion of notices is not possible because the nonce verification fails, since it checks for 'messages_delete_notice'.

[DJPaul]

Hi @tobiashonold

Where you are seeing messages_delete_notice? I can't find that. What theme are you using, and what version of BuddyPress are you looking at this in, please?

Thanks.

[tobiashonold]

2.9.2.

The check is in the file buddypress/bp-messages/bp-messages-actions.php in line 160, inside the bp_messages_action_edit_notice function

check_admin_referer( "messages_{$action}_notice" );

The $action in this case is delete of course. Here it fails if the notice delete button nonce gets created with 'messages_delete_thread' as action.

[DJPaul]

That is an exceptionally great find. I've tracked it back at least 6 years before I gave up, it probably dates back to the first days of the project. I guess this shows how few people use notices, which is an interesting data point that we now have.

Great find @tobiashonold

[djpaul]

In 11750:

Messages: fix nonce for sitewide notice deletion.

Fixes #7622

Props tobiashonold