@djpaul it’s already in trac 
In ajax.php there is a function
function bp_dtheme_new_activity_comment()
On line 194
check_admin_referer( 'new_activity_comment', '_wpnonce_new_activity_comment' );
In activity/entry.php The Nonce matches here.
<?php wp_nonce_field('new_activity_comment', '_wpnonce_new_activity_comment'); ?>
In buddypress/bp-activity/bp-activity-functions.php Line 912
function function bp_activity_new_comment()
Which later calls on line 937
bp_activity_add($args)
$args being sent from the form.
Within the same file there is the function above which preps the data by merging and ostracising into var names.
It then used the BP_Activity_Activity class located in buddypress/activity/bp-activity-classes.php
and checks if the data could not be saved otherwise return the id of the entry.
BP_Activity_Activity instantiates all expected parameters initially with the id if passed. (i’m guessing for an output method).
Saving is the issue here and the method save() on line 62 has 3 global vars $wpdb, $bp and $current_user.
Saving allows for additional filters (to which extent is beyond me here) (… along with the rest).
*gets hairier here
Then…
It checks if some specific filters failed to return a value and if so returns false.
It checks for more specific filter return values and if false sets them to that of the matched user. (primary_link) specifically. How this is used in saving, can only hazard a guess that it’s for outputing a url to the activity stream for permalink.php
http://site.com/members/admin/activity/6060842 for example.
Then using WPDB inserts or updates accordingly.
Maybe we can gain some movement with this here.
Anyone else please do chime in with corrections of the above PSEUDO interpretation, where to go from here is the next one.
