I need to add a button on single profile pages.
The button will send a private message to the user being viewed – but the message is preordained.
(It’s a promotional thing)
So we don’t want to go to a compose page – just send the message.

In member-header.php, I add a button:
`

<a href="” title=””>

`

In bp-custom, I add the functions:
`
function bp_send_private_grrr_link() {
echo bp_get_send_private_bzzzt_link();
}
function bp_get_send_private_bzzzt_link() {
global $bp;

if ( bp_is_my_profile() || !is_user_logged_in() )
return false;

return apply_filters( ‘bp_get_send_private_bzzzt_link’, bp_send_private_bzzzt() );
}

function bp_send_private_grrr() {
$subject = ” I just sent you a BZZT!”;
messages_new_message( array(‘sender_id’ => 1, ‘subject’ => $subject, ‘content’ => “BZZT!”, ‘recipients’ => 9) );
// sender_id & recipients hard-coded for testing
}
`

The above will send a message – But it does so as soon as a profile page is loaded.

How can I stop the message from being sent until the “Send a BZZZT!” button is clicked ?

[@r-a-y Keymaster 13 years, 8 months ago]

Right now, your function is coded so it runs whenever the function is called.
You need to create an action listening function at a predetermined slug so your function should run; or if you’re feeling really up to it, use ajax to send the request.

Check out any action function in BP for hints.

Here’s such an example to get you started:
https://trac.buddypress.org/browser/tags/1.2.8/bp-xprofile.php#L398

[@shanebp Moderator 13 years, 8 months ago]

Thanks for the pointer. Got the listener working.
Here it is, for other noobs…

`
function bp_send_private_bzzt() {
global $bp;

if ( $bp->profile->slug != $bp->current_component || ‘bzzt’ != $bp->current_action || ‘send’ != $bp->action_variables[0] )
return false;

$sender_id = $bp->action_variables[1];
$recip_id = $bp->action_variables[2];
$recip_name = htmlspecialchars(urldecode($bp->action_variables[3]));
$sender_name = $bp->loggedin_user->fullname;

$alert_message = “You just sent a BZZT! to ” . $recip_name;
bp_core_add_message( __( $alert_message, ‘buddypress’ ) );

$subject = $sender_name . ” just sent you a BZZT!”;
messages_new_message( array(‘sender_id’ => $sender_id, ‘subject’ => $subject, ‘content’ => “BZZT!”, ‘recipients’ => $recip_id ) );

bp_core_redirect( wp_get_referer() );
}
add_action( ‘wp’, ‘bp_send_private_bzzt’, 3 );

function bp_send_private_bzzt_link() {
echo bp_get_send_private_bzzt_link();
}
function bp_get_send_private_bzzt_link() {
global $bp;

if ( bp_is_my_profile() || !is_user_logged_in() )
return false;

$sender_id = $bp->loggedin_user->id;
$recip_id = $bp->displayed_user->id;
$recip_name = $bp->displayed_user->fullname;

return apply_filters( ‘bp_get_send_private_bzzt_link’, wp_nonce_url( $bp->displayed_user->domain . $bp->profile->slug . ‘/bzzt/send/’ . $sender_id . ‘/’ . $recip_id . ‘/’ . $recip_name . ‘/’) );
}
`

[@r-a-y Keymaster 13 years, 8 months ago]

You should also add some type of nonce verification:
https://codex.wordpress.org/Function_Reference/wp_create_nonce

Reason is in your function anyone can send a Bzzt even if you’re not logged in if they know the correct URL schema.