[Kona Macphee]

Hi guys,

More than two years ago I posted the following bug report:

Ajax validation issue for user auto-complete

A ticket was opened for this bug here:
https://bbpress.trac.wordpress.org/ticket/2864

The issue was marked as fixed and the bug closed; however, the bug is not actually fixed and is still present in the most recent release.

Here are the original details:

Context:

On the “Edit Topic” screen, there’s an “Author Information” box including an ID field. When you begin to type text into this box, the admin-ajax action “bbp_suggest_user” should auto-suggest potentially matching users.

Issue:
The user autosuggest is not returning any users, just “-1”. Having dug into the code, the step that’s failing is wp_verify_nonce() in check_ajax_referrer(), which is invoked on line 745 of bbPress file includes/admin/admin.php. The nonce is making it into wp_verify_nonce, but is not matching any expected/acceptable value – so wp_verify_nonce falls out the bottom with a failure.

If I remove the check_ajax_referrer step, the Edit Topic user auto-suggestion works perfectly so it’s definitely the nonce validation step that’s the problem.

Current context in which I’m still seeing the bug is WP 4.8.1 Multisite, bbPress 2.5.14, PHP 7.0.22. (I’ve been seeing the bug for over 2 years though, including with PHP 5.x).

Would be really grateful if this bug could be fixed in the next release, because I’m having to manually patch every release at the moment (I have a user whose job relies on this function working properly.)

Thanks!