Skip to:
Content

BuddyPress.org

Opened 11 months ago

Closed 8 months ago

#8007 closed defect (bug) (fixed)

BP blogmeta update routine incorrectly overwrites 'post_title' for unrelated activities

Reported by: r-a-y Owned by: boonebgorges
Milestone: 4.2.0 Priority: normal
Severity: normal Version: 2.1
Component: Blogs Keywords: has-unit-tests has-patch commit
Cc:

Description

When a blog post is updated, a few things are synced if there is a corresponding activity item.

@boonebgorges discovered a bug if:

  • the WP site is using multisite; and
  • if the blog post contains comments; and
  • if there are corresponding 'new_blog_comment' activity items; and
  • if the post title has changed

What happens is the post title activity meta entry is updated for each 'new_blog_comment' activity item where the post comment ID is the same across the entire network.

The problem occurs here:
https://buddypress.trac.wordpress.org/browser/tags/3.2.0/src/bp-blogs/bp-blogs-functions.php?marks=662-666#L634.

When querying for old-style activity comment items, the activity query only does a search on the 'action', 'object', and 'secondary_id' - but not 'primary_id'. As such, it returns a large number of activity items associated with posts on different sites (bad) and then proceeds to update the metadata on them (worse).

I've attached a unit test exhibiting the bug, as well as the patch that fixes the issue.

This bug was introduced as part of #5609.

Attachments (2)

8007.unit-test.patch (2.6 KB) - added by r-a-y 11 months ago.
8007.01.patch (509 bytes) - added by r-a-y 11 months ago.

Download all attachments as: .zip

Change History (8)

@r-a-y
11 months ago

#1 @DJPaul
11 months ago

Nice simple patch, I like it.

#2 @boonebgorges
11 months ago

  • Keywords commit added
  • Milestone changed from Up Next to 4.1.0

Fix looks right to me. Thanks!

This ticket was mentioned in Slack in #buddypress by boone. View the logs.


11 months ago

#4 @boonebgorges
11 months ago

  • Owner set to boonebgorges
  • Resolution set to fixed
  • Status changed from new to closed

In 12311:

Blogs: Ensure activity data integrity when updating post title.

Previously, a missing primary_id could cause the post_title activity meta
value to be updated for activity items unrelated to the one linked to the
updated blog post.

Props r-a-y.
Fixes #8007.

#5 @boonebgorges
8 months ago

  • Milestone changed from 4.1.0 to 4.2.0
  • Resolution fixed deleted
  • Status changed from closed to reopened

This didn't get merged to the 4.0 branch.

#6 @boonebgorges
8 months ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 12333:

Blogs: Ensure activity data integrity when updating post title.

Previously, a missing primary_id could cause the post_title activity meta
value to be updated for activity items unrelated to the one linked to the
updated blog post.

Merges [12311] to the 4.0.x branch.

Props r-a-y.
Fixes #8007.

Note: See TracTickets for help on using tickets.