Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Notification emails contain content from the wrong post #184

Closed
matthewf-ucsd opened this issue Oct 21, 2019 · 3 comments
Closed

Notification emails contain content from the wrong post #184

matthewf-ucsd opened this issue Oct 21, 2019 · 3 comments
Milestone

Comments

@matthewf-ucsd
Copy link

When a user creates a new post to a group blog, the notifications that are sent out to users contain the content from the wrong post.

In bp-activity-subscription-functions.php, bpges_generate_notification(), after the comment:

// Use bbPress filtered post content and reapply GES filter... sigh.

... since the call to get_post_field( 'post_content', $activity->secondary_item_id, 'raw' ) is being made in the context of the primary blog, it is getting the content for an unrelated post and sending that in the notification to group users

This can lead to exposing, for example, posts to forums of private groups.

I'm going to work around this by switching back to the post's blog before getting the post text:

switch_to_blog(get_groupblog_blog_id( $group->id ));
$the_content = get_post_field( 'post_content', $activity->secondary_item_id, 'raw' );
switch_to_blog( bp_get_root_blog_id() );
@r-a-y
Copy link
Collaborator

r-a-y commented Oct 21, 2019

Thanks for the catch, @matthewf-ucsd.

Bug was introduced by me in commit 912056c. Will have a fix shortly.

@matthewf-ucsd
Copy link
Author

Thank you for the fast fix!

@boonebgorges boonebgorges added this to the 3.9.5 milestone Oct 22, 2019
@boonebgorges
Copy link
Owner

Thanks, @r-a-y !

@boonebgorges boonebgorges modified the milestones: 3.9.5, 4.0.0 Jul 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants