Automattic / Automattic/crowdsignal-plugin
Derive usercode server-side in polls_upload_image instead of accepting it as a parameter
- Dominant language
- PHP
- Stars
- 15
- Forks
- 11
- Avg merge
- 14m
- Merged PRs (30d)
- 1
Description
The `polls_upload_image` AJAX handler (`Polldaddy_Ajax::ajax_upload_image()` in `ajax.php`) reads the usercode from `$_POST['uc']`. Since the handler only runs for logged-in users, this value can be derived from the current user instead of being passed in.
Proposed change: drop `$_POST['uc']` and read the usercode server-side, e.g.:
```php
$user_code = get_option( 'pd-usercode-' . get_current_user_id() );
if ( empty( $user_code ) ) {
$user_code = get_option( 'crowdsignal_user_code' );
}
```
This is the same value the editor already renders into the hidden `uc` field, so the field in `partials/poll-edit-form.php` can be removed too. Add a test covering the server-side derivation.
Contributor guide
Research direction
Start in ajax.php at Polldaddy_Ajax::ajax_upload_image() and compare its usercode handling with the hidden field in partials/poll-edit-form.php. Verify the server-side value uses the current user and fallback described in the issue, remove the field, and add a test covering the derivation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php, wordpress
- Domain
- backend, security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100