Ticket #16188: 16188.diff

wp-includes/js/tinymce/plugins/wplink/js/wplink.dev.js

@@ -433 +433 @@
                         var self = this,
                                 query = {
                                         action : 'wp-link-ajax',
-                                        page : this.page
+                                        page : this.page,
+                                        '_ajax_linking_nonce' : $('#_ajax_linking_nonce').val()
                                 };
 
                         if ( this.search )

wp-admin/admin-ajax.php

@@ -57 +57 @@
         $current_screen->is_network = 'false' === $current_screen->is_network ? false : true;
         $current_screen->is_user = 'false' === $current_screen->is_user ? false : true;
 
+        $list_class = $_GET['list_args']['class'];
+
+        check_ajax_referer( "fetch-list-$list_class", '_ajax_fetch_list_nonce' );
+
         define( 'WP_NETWORK_ADMIN', $current_screen->is_network );
         define( 'WP_USER_ADMIN', $current_screen->is_user );
 
-        $wp_list_table = get_list_table( $_GET['list_args']['class'] );
+        $wp_list_table = get_list_table( $list_class );
         if ( ! $wp_list_table )
                 die( '0' );
 
@@ -1089 +1093 @@
 case 'wp-link-ajax':
         require_once ABSPATH . 'wp-admin/includes/internal-linking.php';
 
+        check_ajax_referer( 'internal-linking', '_ajax_linking_nonce' );
+
         $args = array();
 
         if ( isset( $_POST['search'] ) )

wp-admin/includes/internal-linking.php

@@ -71 +71 @@
 function wp_link_dialog() {
 ?>
 <form id="wp-link" tabindex="-1">
+<?php wp_nonce_field( 'internal-linking', '_ajax_linking_nonce', false ); ?>
 <div id="link-selector">
         <div id="link-options">
                 <p class="howto"><?php _e( 'Enter the destination URL' ); ?></p>

wp-admin/includes/class-wp-list-table.php

@@ -685 +685 @@
         function display() {
                 extract( $this->_args );
 
+                wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
+
                 $this->display_tablenav( 'top' );
 
 ?>

wp-admin/js/list-table.dev.js

@@ -86 +86 @@
         fetch_list: function(data, success_callback, error_callback) {
                 data = $.extend(data, {
                         'action': 'fetch-list',
-                        'list_args': list_args
+                        'list_args': list_args,
+                        '_ajax_fetch_list_nonce': $('#_ajax_fetch_list_nonce').val()
                 });
 
                 $.ajax({