Updated to Elgg 1.8.16.

2 files changed, 57 insertions, 30 deletions

diff --git a/actions/friends/add.php b/actions/friends/add.php
index 04168c4c3..38c29448b 100644
--- a/actions/friends/add.php
+++ b/actions/friends/add.php
@@ -1,29 +1,45 @@
 <?php
+/**
+ * Elgg add friend action
+ *
+ * @package Elgg.Core
+ * @subpackage Friends.Management
+ */
 
-$friend = get_entity(sanitize_int(get_input('friend')));
-$user = elgg_get_logged_in_user_entity();
-
-if(!elgg_instanceof($friend, 'user')){
-	register_error(elgg_echo('friendrequest:add:failure'));
+// Get the GUID of the user to friend
+$friend_guid = get_input('friend');
+$friend = get_entity($friend_guid);
+if (!$friend) {
+	register_error(elgg_echo('error:missing_data'));
 	forward(REFERER);
 }
+$user = elgg_get_logged_in_user_entity();
+
+$errors = false;
 
 if(check_entity_relationship($friend->guid, "friendrequest", $user->guid)
 	|| check_entity_relationship($friend->guid, "friend", $user->guid)) {
-	
-	$user->addFriend($friend->guid);
 
-	$friend->addFriend($user->guid);
-	remove_entity_relationship($friend->guid, "friendrequest", $user->guid);
-	
-	add_to_river('river/relationship/friend/create', 'friend', $user->guid, $friend->guid);
-	add_to_river('river/relationship/friend/create', 'friend', $friend->guid, $user->guid);
-	system_message(elgg_echo("friends:add:successful", array($friend->name)));
-	
+	try {
+		if (!$user->addFriend($friend_guid)) {
+			$errors = true;
+		}
+		remove_entity_relationship($friend->guid, "friendrequest", $user->guid);
+	} catch (Exception $e) {
+		register_error(elgg_echo("friends:add:failure", array($friend->name)));
+		$errors = true;
+	}
+	if (!$errors) {
+		// add to river
+		add_to_river('river/relationship/friend/create', 'friend', $user->guid, $friend->guid);
+		add_to_river('river/relationship/friend/create', 'friend', $friend->guid, $user->guid);
+		system_message(elgg_echo("friends:add:successful", array($friend->name)));
+	}
 } elseif(add_entity_relationship($user->guid, "friendrequest", $friend->guid)) {
 	system_message(elgg_echo("friendrequest:add:successful", array($friend->name)));
 } else {
 	register_error(elgg_echo("friendrequest:add:exists", array($friend->name)));
 }
 
+// Forward back to the page you friended the user on
 forward(REFERER);
diff --git a/actions/friends/remove.php b/actions/friends/remove.php
index 1ad9471b3..786f08352 100644
--- a/actions/friends/remove.php
+++ b/actions/friends/remove.php
@@ -1,24 +1,35 @@
 <?php
+/**
+ * Elgg remove friend action
+ *
+ * @package Elgg.Core
+ * @subpackage Friends.Management
+ */
 
-$friend = get_entity(sanitize_int(get_input('friend')));
-$user = elgg_get_logged_in_user_entity();
+// Get the GUID of the user to friend
+$friend_guid = get_input('friend');
+$friend = get_entity($friend_guid);
+$errors = false;
 
-if(!elgg_instanceof($friend, 'user')){
-	register_error(elgg_echo('friends:remove:failure', array($friend->name)));
-	forward(REFERER);
+// Get the user
+try{
+	if ($friend instanceof ElggUser) {
+		elgg_get_logged_in_user_entity()->removeFriend($friend_guid);
+		$ia = elgg_set_ignore_access(true);
+		$friend->removeFriend($elgg_get_logged_in_user_guid());
+		elgg_set_ignore_access($ia);
+	} else {
+		register_error(elgg_echo("friends:remove:failure", array($friend->name)));
+		$errors = true;
+	}
+} catch (Exception $e) {
+	register_error(elgg_echo("friends:remove:failure", array($friend->name)));
+	$errors = true;
 }
 
-if(check_entity_relationship($user->guid, "friend", $friend->guid)) {
-	try {
-		$user->removeFriend($friend->guid);
-		if(check_entity_relationship($friend->guid, "friend", $user->guid)){
-			$friend->removeFriend($user->guid);
-		}
-	} catch (Exception $e) {
-		register_error(elgg_echo('friends:remove:failure', array($friend->name)));
-		forward(REFERER);
-	}
+if (!$errors) {
+	system_message(elgg_echo("friends:remove:successful", array($friend->name)));
 }
 
-system_message(elgg_echo('friends:remove:successful', array($friend->name)));
+// Forward back to the page you made the friend on
 forward(REFERER);