← All changes | templates/default/bbpress-functions.php +38 -26 2.6.18 → 2.6.19 View file →

		@@ -4,9 +4,9 @@
4	4	* Functions of the Default template-pack
5	5	*
6	6	* @package bbPress
7	7	* @subpackage BBP_Theme_Compat
8		- * @since 2.1.0 bbPress (r3732)
	8	+ * @since 2.1.0 bbPress (r3734)
9	9	*/
10	10
11	11	// Exit if accessed directly
12	12	defined( 'ABSPATH' ) || exit;
		@@ -26,9 +26,9 @@
26	26	* together; bbPress should safely handle the rest.
27	27	*
28	28	* See @link BBP_Theme_Compat() for more.
29	29	*
30		- * @since 2.1.0 bbPress (r3732)
	30	+ * @since 2.1.0 bbPress (r3734)
31	31	*
32	32	* @package bbPress
33	33	* @subpackage BBP_Theme_Compat
34	34	*/
		@@ -38,9 +38,9 @@
38	38
39	39	/**
40	40	* The main bbPress (Default) Loader
41	41	*
42		- * @since 2.1.0 bbPress (r3732)
	42	+ * @since 2.1.0 bbPress (r3734)
43	43	*/
44	44	public function __construct( $properties = array() ) {
45	45
46	46	parent::__construct(
		@@ -62,9 +62,9 @@
62	62
63	63	/**
64	64	* Setup the theme hooks
65	65	*
66		- * @since 2.1.0 bbPress (r3732)
	66	+ * @since 2.1.0 bbPress (r3734)
67	67	*
68	68	* @access private
69	69	*/
70	70	private function setup_actions() {
		@@ -90,9 +90,9 @@
90	90	/**
91	91	* Inserts HTML at the top of the main content area to be compatible with
92	92	* the Twenty Twelve theme.
93	93	*
94		- * @since 2.1.0 bbPress (r3732)
	94	+ * @since 2.1.0 bbPress (r3734)
95	95	*/
96	96	public function before_main_content() {
97	97	?>
98	98
		@@ -105,9 +105,9 @@
105	105	/**
106	106	* Inserts HTML at the bottom of the main content area to be compatible with
107	107	* the Twenty Twelve theme.
108	108	*
109		- * @since 2.1.0 bbPress (r3732)
	109	+ * @since 2.1.0 bbPress (r3734)
110	110	*/
111	111	public function after_main_content() {
112	112	?>
113	113
		@@ -119,9 +119,9 @@
119	119
120	120	/**
121	121	* Load the theme CSS
122	122	*
123		- * @since 2.1.0 bbPress (r3732)
	123	+ * @since 2.1.0 bbPress (r3734)
124	124	*/
125	125	public function enqueue_styles() {
126	126
127	127	// Setup the default styling
		@@ -151,9 +151,9 @@
151	151
152	152	/**
153	153	* Enqueue the required JavaScript files
154	154	*
155		- * @since 2.1.0 bbPress (r3732)
	155	+ * @since 2.1.0 bbPress (r3734)
156	156	*/
157	157	public function enqueue_scripts() {
158	158
159	159	// Setup scripts array
		@@ -212,9 +212,9 @@
212	212	* Load localizations for topic script
213	213	*
214	214	* These localizations require information that may not be loaded even by init.
215	215	*
216		- * @since 2.1.0 bbPress (r3732)
	216	+ * @since 2.1.0 bbPress (r3734)
217	217	*/
218	218	public function localize_topic_script() {
219	219
220	220	// Single forum or topic
		@@ -233,9 +233,9 @@
233	233
234	234	/**
235	235	* AJAX handler to add or remove a topic from a user's favorites
236	236	*
237		- * @since 2.1.0 bbPress (r3732)
	237	+ * @since 2.1.0 bbPress (r3734)
238	238	*/
239	239	public function ajax_favorite() {
240	240
241	241	// Bail if favorites are not active
		@@ -250,9 +250,12 @@
250	250
251	251	// Get user and topic data
252	252	$user_id = bbp_get_current_user_id();
253	253	$id = ! empty( $_POST['id'] ) ? intval( $_POST['id'] ) : 0;
254		- $type = ! empty( $_POST['type'] ) ? sanitize_key( $_POST['type'] ) : 'post';
	254	+ $type = 'post';
	255	+ if ( ! empty( $_POST['type'] ) ) {
	256	+ $type = is_string( $_POST['type'] ) ? sanitize_key( $_POST['type'] ) : '';
	257	+ }
255	258
256	259	// Bail if user cannot add favorites for this user
257	260	if ( ! current_user_can( 'edit_user', $user_id ) ) {
258	261	bbp_ajax_response( false, esc_html__( 'You do not have permission to do this.', 'bbpress' ), 302 );
		@@ -258,14 +261,17 @@
258	261	bbp_ajax_response( false, esc_html__( 'You do not have permission to do this.', 'bbpress' ), 302 );
259	262	}
260	263
261	264	// Get the object
262		- if ( 'post' === $type ) {
263		- $object = get_post( $id );
	265	+ $object = get_post( $id );
	266	+
	267	+ // Validate the object before checking its favorite state
	268	+ if ( empty( $object ) || ! bbp_current_user_can_toggle_engagement( $object->ID, $type, 'favorite', 'remove' ) ) {
	269	+ bbp_ajax_response( false, esc_html__( 'Favorite failed.', 'bbpress' ), 303 );
264	270	}
265		-
266		- // Bail if topic cannot be found
267		- if ( empty( $object ) ) {
	271	+ $is_favorite = bbp_is_user_favorite( $user_id, $object->ID );
	272	+ $toggle_action = $is_favorite ? 'remove' : 'add';
	273	+ if ( ! bbp_current_user_can_toggle_engagement( $object->ID, $type, 'favorite', $toggle_action ) ) {
268	274	bbp_ajax_response( false, esc_html__( 'Favorite failed.', 'bbpress' ), 303 );
269	275	}
270	276
271	277	// Bail if user did not take this action
		@@ -273,9 +279,9 @@
273	279	bbp_ajax_response( false, esc_html__( 'Are you sure you meant to do that?', 'bbpress' ), 304 );
274	280	}
275	281
276	282	// Take action
277		- $status = bbp_is_user_favorite( $user_id, $object->ID )
	283	+ $status = $is_favorite
278	284	? bbp_remove_user_favorite( $user_id, $object->ID )
279	285	: bbp_add_user_favorite( $user_id, $object->ID );
280	286
281	287	// Bail if action failed
		@@ -296,9 +302,9 @@
296	302
297	303	/**
298	304	* AJAX handler to Subscribe/Unsubscribe a user from a topic
299	305	*
300		- * @since 2.1.0 bbPress (r3732)
	306	+ * @since 2.1.0 bbPress (r3734)
301	307	*/
302	308	public function ajax_subscription() {
303	309
304	310	// Bail if subscriptions are not active
		@@ -313,9 +319,12 @@
313	319
314	320	// Get user and topic data
315	321	$user_id = bbp_get_current_user_id();
316	322	$id = ! empty( $_POST['id'] ) ? intval( $_POST['id'] ) : 0;
317		- $type = ! empty( $_POST['type'] ) ? sanitize_key( $_POST['type'] ) : 'post';
	323	+ $type = 'post';
	324	+ if ( ! empty( $_POST['type'] ) ) {
	325	+ $type = is_string( $_POST['type'] ) ? sanitize_key( $_POST['type'] ) : '';
	326	+ }
318	327
319	328	// Bail if user cannot add favorites for this user
320	329	if ( ! current_user_can( 'edit_user', $user_id ) ) {
321	330	bbp_ajax_response( false, esc_html__( 'You do not have permission to do this.', 'bbpress' ), 302 );
		@@ -321,24 +330,27 @@
321	330	bbp_ajax_response( false, esc_html__( 'You do not have permission to do this.', 'bbpress' ), 302 );
322	331	}
323	332
324	333	// Get the object
325		- if ( 'post' === $type ) {
326		- $object = get_post( $id );
	334	+ $object = get_post( $id );
	335	+
	336	+ // Validate the object before checking its subscription state
	337	+ if ( empty( $object ) || ! bbp_current_user_can_toggle_engagement( $object->ID, $type, 'subscription', 'remove' ) ) {
	338	+ bbp_ajax_response( false, esc_html__( 'Subscription failed.', 'bbpress' ), 303 );
327	339	}
328		-
329		- // Bail if topic cannot be found
330		- if ( empty( $object ) ) {
	340	+ $is_subscribed = bbp_is_user_subscribed( $user_id, $object->ID, $type );
	341	+ $toggle_action = $is_subscribed ? 'remove' : 'add';
	342	+ if ( ! bbp_current_user_can_toggle_engagement( $object->ID, $type, 'subscription', $toggle_action ) ) {
331	343	bbp_ajax_response( false, esc_html__( 'Subscription failed.', 'bbpress' ), 303 );
332	344	}
333	345
334	346	// Bail if user did not take this action
335		- if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'toggle-subscription_' . $object->ID ) ) {
	347	+ if ( ! isset( $_POST['nonce'] ) || ( ! wp_verify_nonce( $_POST['nonce'], 'toggle-subscription_post_' . $object->ID ) && ! wp_verify_nonce( $_POST['nonce'], 'toggle-subscription_' . $object->ID ) ) ) {
336	348	bbp_ajax_response( false, esc_html__( 'Are you sure you meant to do that?', 'bbpress' ), 304 );
337	349	}
338	350
339	351	// Take action
340		- $status = bbp_is_user_subscribed( $user_id, $object->ID )
	352	+ $status = $is_subscribed
341	353	? bbp_remove_user_subscription( $user_id, $object->ID )
342	354	: bbp_add_user_subscription( $user_id, $object->ID );
343	355
344	356	// Bail if action failed