CUNY Academic Commons

Thanks for the report, Sonja.

I did some quick debugging. The AJAX request was returning a 403 Forbidden error. I traced this to a

check_admin_referer()

failure in BP's AJAX callbacks. The _wpnonce value was being sent as part of the POST payload, so I figured it must be the wrong value, and I had a hunch it might be that the nonce was being generated for one user, then the _wpnonce element was being cached as part of the bp-widget-cache HTML cache, and then served to other users. I deactivated the bp-widget-cached plugin and the requests now work, which supports my hypothesis, though I didn't spend any more time looking into it.

Ray, can you have a look? If there's an easy way to put the nonce outside the cached value, so as to ensure that it is regenerated on each pageload, it should solve the problem.

Good catch, Sonja!

Boone is absolutely correct. I've addressed this in https://github.com/cuny-academic-commons/cac/commit/1aaa6c463499f5d2737a7c42d284332198a1aad7 by replacing the cached nonces with the correct nonce at run-time for the widget cache.