Skip to content

Commit 9b9de17

Browse files
committed
Fix #8090 wrong wall message delete
1 parent 4aaf4b2 commit 9b9de17

File tree

1 file changed

+13
-4
lines changed

1 file changed

+13
-4
lines changed

main/social/profile.php

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,19 @@
5050
exit;
5151

5252
} else if (isset($_GET['messageId'])) {
53-
$messageId = Security::remove_XSS($_GET['messageId']);
54-
$status = SocialManager::deleteMessage($messageId);
55-
header('Location: ' . api_get_path(WEB_CODE_PATH) . 'social/profile.php');
56-
exit;
53+
$messageId = intval($_GET['messageId']);
54+
$messageInfo = MessageManager::get_message_by_id($messageId);
55+
if (!empty($messageInfo)) {
56+
// I can only delete messages of my own wall
57+
if ($messageInfo['user_receiver_id'] == $user_id) {
58+
$status = SocialManager::deleteMessage($messageId);
59+
60+
Display::addFlash(Display::return_message(get_lang('MessageDeleted')));
61+
header('Location: ' . api_get_path(WEB_CODE_PATH) . 'social/profile.php');
62+
exit;
63+
}
64+
}
65+
api_not_allowed(true);
5766

5867
} else if (isset($_GET['u'])) { //I'm your friend? I can see your profile?
5968
$user_id = intval($_GET['u']);

0 commit comments

Comments
 (0)