File tree Expand file tree Collapse file tree 1 file changed +13
-4
lines changed Expand file tree Collapse file tree 1 file changed +13
-4
lines changed Original file line number Diff line number Diff line change 50
50
exit ;
51
51
52
52
} else if (isset ($ _GET ['messageId ' ])) {
53
- $ messageId = Security::remove_XSS ($ _GET ['messageId ' ]);
54
- $ status = SocialManager::deleteMessage ($ messageId );
55
- header ('Location: ' . api_get_path (WEB_CODE_PATH ) . 'social/profile.php ' );
56
- exit ;
53
+ $ messageId = intval ($ _GET ['messageId ' ]);
54
+ $ messageInfo = MessageManager::get_message_by_id ($ messageId );
55
+ if (!empty ($ messageInfo )) {
56
+ // I can only delete messages of my own wall
57
+ if ($ messageInfo ['user_receiver_id ' ] == $ user_id ) {
58
+ $ status = SocialManager::deleteMessage ($ messageId );
59
+
60
+ Display::addFlash (Display::return_message (get_lang ('MessageDeleted ' )));
61
+ header ('Location: ' . api_get_path (WEB_CODE_PATH ) . 'social/profile.php ' );
62
+ exit ;
63
+ }
64
+ }
65
+ api_not_allowed (true );
57
66
58
67
} else if (isset ($ _GET ['u ' ])) { //I'm your friend? I can see your profile?
59
68
$ user_id = intval ($ _GET ['u ' ]);
You can’t perform that action at this time.
0 commit comments