Fixed Unliking content without a content_user_id doesn't remove item from news feed


Active member
Basically the same thing here:

Except that the like isn't removed if your content isn't associated with a content_user_id. So it won't really affect XF in general, but if you created custom content types which doesn't require an author then you can "like bomb" the news feed.

In XenForo_Model_Like line 272:
        if ($like['content_user_id'])
                UPDATE xf_user
                SET like_count = IF(like_count > 1, like_count - 1, 0)
                WHERE user_id = ?
            ', $like['content_user_id']);
                $like['content_type'], $like['content_id'], $like['like_user_id'], 'like'
                $like['content_type'], $like['content_id'], $like['like_user_id'], 'like'
Should it be just as easy as simply moving the delete actions for the alerts and news feed outside of the if statement? Or is there any particular reason/cases deleting a news feed item/alert would require a content_user_id?


XenForo developer
Staff member
Just the news feed bit needs to be moved out - the alert is only given if there's a content user.