Skip to content

Commit 3650e44

Browse files
AngelFQCAngelFQC
committed
Social: Secure requests to delete posts and comments
1 parent a968231 commit 3650e44

File tree

2 files changed

+44
-51
lines changed

2 files changed

+44
-51
lines changed

‎main/inc/ajax/social.ajax.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -245,14 +245,21 @@
245245
exit;
246246
}
247247

248+
if (!Security::check_token('get', null, 'social')) {
249+
exit;
250+
}
251+
248252
$userId = api_get_user_id();
249253
$messageInfo = MessageManager::get_message_by_id($messageId);
250254
if (!empty($messageInfo)) {
251255
$canDelete = ($messageInfo['user_receiver_id'] == $userId || $messageInfo['user_sender_id'] == $userId) &&
252256
empty($messageInfo['group_id']);
253257
if ($canDelete || api_is_platform_admin()) {
254258
SocialManager::deleteMessage($messageId);
255-
echo Display::return_message(get_lang('MessageDeleted'));
259+
echo json_encode([
260+
'message' => Display::return_message(get_lang('MessageDeleted')),
261+
'secToken' => Security::get_token('social')
262+
]);
256263
break;
257264
}
258265
}

‎main/inc/lib/social.lib.php‎

Lines changed: 36 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1963,14 +1963,16 @@ class="avatar-thumb">
19631963

19641964
$isOwnWall = $currentUserId == $userIdLoop || $currentUserId == $receiverId;
19651965
if ($isOwnWall) {
1966-
$comment .= Display::url(
1967-
Display::returnFontAwesomeIcon('trash', '', true),
1968-
'javascript:void(0)',
1966+
$comment .= Display::button(
1967+
'',
1968+
Display::returnFontAwesomeIcon('trash', '', true),
19691969
[
19701970
'id' => 'message_'.$message['id'],
19711971
'title' => get_lang('SocialMessageDelete'),
1972-
'onclick' => 'deleteComment('.$message['id'].')',
1973-
'class' => 'btn btn-default',
1972+
'type' => 'button',
1973+
'class' => 'btn btn-default btn-delete-social-comment',
1974+
'data-id' => $message['id'],
1975+
'data-sectoken' => Security::get_existing_token('social'),
19741976
]
19751977
);
19761978
}
@@ -3017,30 +3019,6 @@ public static function getScrollJs($countPost, &$htmlHeadXtra)
30173019
}
30183020

30193021
$htmlHeadXtra[] = '<script>
3020-
function deleteMessage(id)
3021-
{
3022-
$.ajax({
3023-
url: "'.$socialAjaxUrl.'?a=delete_message" + "&id=" + id,
3024-
success: function (result) {
3025-
if (result) {
3026-
$("#message_" + id).parent().parent().parent().parent().html(result);
3027-
}
3028-
}
3029-
});
3030-
}
3031-
3032-
function deleteComment(id)
3033-
{
3034-
$.ajax({
3035-
url: "'.$socialAjaxUrl.'?a=delete_message" + "&id=" + id,
3036-
success: function (result) {
3037-
if (result) {
3038-
$("#message_" + id).parent().parent().parent().html(result);
3039-
}
3040-
}
3041-
});
3042-
}
3043-
30443022
function submitComment(messageId)
30453023
{
30463024
var data = $("#form_comment_"+messageId).serializeArray();
@@ -3069,33 +3047,39 @@ function submitComment(messageId)
30693047
$(function() {
30703048
timeAgo();
30713049
3072-
/*$(".delete_message").on("click", function() {
3073-
var id = $(this).attr("id");
3074-
id = id.split("_")[1];
3075-
$.ajax({
3076-
url: "'.$socialAjaxUrl.'?a=delete_message" + "&id=" + id,
3077-
success: function (result) {
3050+
$("body").on("click", ".btn-delete-social-message", function () {
3051+
var id = $(this).data("id");
3052+
var secToken = $(this).data("sectoken");
3053+
3054+
$.getJSON(
3055+
"'.$socialAjaxUrl.'",
3056+
{ a: "delete_message", id: id, social_sec_token: secToken },
3057+
function (result) {
30783058
if (result) {
3079-
$("#message_" + id).parent().parent().parent().parent().html(result);
3059+
$("#message_" + id).parent().parent().parent().parent().html(result.message);
3060+
3061+
$(".btn-delete-social-message").data("sectoken", result.secToken);
30803062
}
30813063
}
3082-
});
3064+
);
30833065
});
30843066
3067+
$("body").on("click", ".btn-delete-social-comment", function () {
3068+
var id = $(this).data("id");
3069+
var secToken = $(this).data("sectoken");
30853070
3086-
$(".delete_comment").on("click", function() {
3087-
var id = $(this).attr("id");
3088-
id = id.split("_")[1];
3089-
$.ajax({
3090-
url: "'.$socialAjaxUrl.'?a=delete_message" + "&id=" + id,
3091-
success: function (result) {
3071+
$.getJSON(
3072+
"'.$socialAjaxUrl.'",
3073+
{ a: "delete_message", id: id, social_sec_token: secToken },
3074+
function (result) {
30923075
if (result) {
3093-
$("#message_" + id).parent().parent().parent().html(result);
3076+
$("#message_" + id).parent().parent().parent().html(result.message);
3077+
3078+
$(".btn-delete-social-comment").data("sectoken", result.secToken);
30943079
}
30953080
}
3096-
});
3081+
);
30973082
});
3098-
*/
30993083
});
31003084
31013085
function timeAgo() {
@@ -3467,14 +3451,16 @@ private static function headerMessagePost($authorInfo, $receiverInfo, $message)
34673451
);
34683452

34693453
if ($canEdit) {
3470-
$htmlDelete = Display::url(
3454+
$htmlDelete = Display::button(
3455+
'',
34713456
Display::returnFontAwesomeIcon('trash', '', true),
3472-
'javascript:void(0)',
34733457
[
34743458
'id' => 'message_'.$message['id'],
34753459
'title' => get_lang('SocialMessageDelete'),
3476-
'onclick' => 'deleteMessage('.$message['id'].')',
3477-
'class' => 'btn btn-default',
3460+
'type' => 'button',
3461+
'class' => 'btn btn-default btn-delete-social-message',
3462+
'data-id' => $message['id'],
3463+
'data-sectoken' => Security::get_existing_token('social'),
34783464
]
34793465
);
34803466

0 commit comments

Comments
 (0)