Automattic / Automattic/crowdsignal-plugin

Derive usercode server-side in polls_upload_image instead of accepting it as a parameter

Open
#153 1 comment 0 reactions 0 assignees View on GitHub
status: ready-for-agent type: bug
Dominant language
PHP
Stars
15
Forks
11
Avg merge
14m
Merged PRs (30d)
1

Description

The `polls_upload_image` AJAX handler (`Polldaddy_Ajax::ajax_upload_image()` in `ajax.php`) reads the usercode from `$_POST['uc']`. Since the handler only runs for logged-in users, this value can be derived from the current user instead of being passed in.

Proposed change: drop `$_POST['uc']` and read the usercode server-side, e.g.:

```php
$user_code = get_option( 'pd-usercode-' . get_current_user_id() );
if ( empty( $user_code ) ) {
$user_code = get_option( 'crowdsignal_user_code' );
}
```

This is the same value the editor already renders into the hidden `uc` field, so the field in `partials/poll-edit-form.php` can be removed too. Add a test covering the server-side derivation.

Contributor guide

Open the contributing guide

Research direction

Start in ajax.php at Polldaddy_Ajax::ajax_upload_image() and compare its usercode handling with the hidden field in partials/poll-edit-form.php. Verify the server-side value uses the current user and fallback described in the issue, remove the field, and add a test covering the derivation.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
backend, security
Issue type
Refactor
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.