fix(friends): check friendship relationship before change

fixes #11975
Elgg · May 24, 2018 · ccd6fbb · ccd6fbb
1 parent 99964cc
commit ccd6fbb
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 17 deletions.
diff --git a/actions/friends/add.php b/actions/friends/add.php
@@ -7,18 +7,20 @@
  */
 
 // Get the GUID of the user to friend
-$friend_guid = get_input('friend');
+$friend_guid = (int) get_input('friend');
-$friend = get_user($friend_guid);
 
+$friend = get_user($friend_guid);
 if (!$friend) {
-	register_error(elgg_echo('error:missing_data'));
+	return elgg_error_response(elgg_echo('error:missing_data'));
-	forward(REFERER);
+}
+
+$user = elgg_get_logged_in_user_entity();
+if ($user->isFriendsWith($friend->guid)) {
+	return elgg_ok_response('', elgg_echo('friends:add:duplicate', [$friend->getDisplayName()]));
 }
 
 if (!elgg_get_logged_in_user_entity()->addFriend($friend->guid, true)) {
-	register_error(elgg_echo("friends:add:failure", array($friend->name)));
+	return elgg_error_response(elgg_echo('friends:add:failure', [$friend->getDisplayName()]));
-	forward(REFERER);
 }
 
-system_message(elgg_echo("friends:add:successful", array($friend->name)));
+return elgg_ok_response('', elgg_echo('friends:add:successful', [$friend->getDisplayName()]));
-forward(REFERER);
diff --git a/actions/friends/remove.php b/actions/friends/remove.php
@@ -7,19 +7,20 @@
  */
 
 // Get the GUID of the user to friend
-$friend_guid = get_input('friend');
+$friend_guid = (int) get_input('friend');
-$friend = get_user($friend_guid);
 
+$friend = get_user($friend_guid);
 if (!$friend) {
-	register_error(elgg_echo('error:missing_data'));
+	return elgg_error_response(elgg_echo('error:missing_data'));
-	forward(REFERER);
 }
 
-if (!elgg_get_logged_in_user_entity()->removeFriend($friend->guid)) {
+$user = elgg_get_logged_in_user_entity();
-	register_error(elgg_echo("friends:remove:failure", array($friend->name)));
+if (!$user->isFriendsWith($friend->guid)) {
-	forward(REFERER);
+	return elgg_ok_response('', elgg_echo('friends:remove:no_friend', [$friend->getDisplayName()]));
 }
 
-system_message(elgg_echo("friends:remove:successful", array($friend->name)));
+if (!elgg_get_logged_in_user_entity()->removeFriend($friend->guid)) {
-forward(REFERER);
+	return elgg_error_response(elgg_echo('friends:remove:failure', [$friend->getDisplayName()]));
+}
 
+return elgg_ok_response('', elgg_echo('friends:remove:successful', [$friend->getDisplayName()]));
diff --git a/languages/en.php b/languages/en.php
@@ -247,9 +247,11 @@
 	'friend:remove' => "Remove friend",
 
 	'friends:add:successful' => "You have successfully added %s as a friend.",
+	'friends:add:duplicate' => "You're already friends with %s",
 	'friends:add:failure' => "We couldn't add %s as a friend.",
 
 	'friends:remove:successful' => "You have successfully removed %s from your friends.",
+	'friends:remove:no_friend' => "You and %s are not friends",
 	'friends:remove:failure' => "We couldn't remove %s from your friends.",
 
 	'friends:none' => "No friends yet.",