Ticket #2678: nonce.6.diff

File nonce.6.diff, 28.5 KB (added by ryan, 6 years ago)

Nonce comments, pages, and options.

  • wp-includes/functions-compat.php

     
    9898    } 
    9999} 
    100100 
     101// From php.net 
     102if(!function_exists('http_build_query')) { 
     103   function http_build_query( $formdata, $numeric_prefix = null, $key = null ) { 
     104       $res = array(); 
     105       foreach ((array)$formdata as $k=>$v) { 
     106           $tmp_key = urlencode(is_int($k) ? $numeric_prefix.$k : $k); 
     107           if ($key) $tmp_key = $key.'['.$tmp_key.']'; 
     108           $res[] = ( ( is_array($v) || is_object($v) ) ? http_build_query($v, null, $tmp_key) : $tmp_key."=".urlencode($v) ); 
     109       } 
     110       $separator = ini_get('arg_separator.output'); 
     111       return implode($separator, $res); 
     112   } 
     113} 
    101114?> 

  • wp-includes/functions.php

     
    16631663        return $installed; 
    16641664} 
    16651665 
     1666function wp_nonce_url($actionurl, $action = -1) { 
     1667        return add_query_arg('_wpnonce', wp_create_nonce($action), $actionurl); 
     1668} 
     1669 
     1670function wp_nonce_field($action = -1) { 
     1671        echo '<input type="hidden" name="_wpnonce" value="' . wp_create_nonce($action) . '" />'; 
     1672} 
     1673 
    16661674?> 

  • wp-includes/pluggable-functions.php

     
    228228endif; 
    229229 
    230230if ( !function_exists('check_admin_referer') ) : 
    231 function check_admin_referer() { 
     231function check_admin_referer($action = -1) { 
     232        global $pagenow; 
    232233        $adminurl = strtolower(get_settings('siteurl')).'/wp-admin'; 
    233234        $referer = strtolower($_SERVER['HTTP_REFERER']); 
    234         if (!strstr($referer, $adminurl)) 
    235                 die(__('Sorry, you need to <a href="http://codex.wordpress.org/Enable_Sending_Referrers">enable sending referrers</a> for this feature to work.')); 
     235        if ( !wp_verify_nonce($_REQUEST['_wpnonce'], $action) ) { 
     236                $html  = "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'>\n<html xmlns='http://www.w3.org/1999/xhtml' lang='en' xml:lang='en'>\n\n"; 
     237                $html .= "<head>\n\t<title>" . __('WordPress Confirmation') . "</title>\n"; 
     238                $html .= "</head>\n<body>\n"; 
     239                if ( $_POST ) { 
     240                        $q = http_build_query($_POST); 
     241                        $q = explode( ini_get('arg_separator.output'), $q); 
     242                        $html .= "\t<form method='post' action='$pagenow'>\n"; 
     243                        foreach ( (array) $q as $a ) { 
     244                                $v = substr(strstr($a, '='), 1); 
     245                                $k = substr($a, 0, -(strlen($v)+1)); 
     246                                $html .= "\t\t<input type='hidden' name='" . wp_specialchars( urldecode($k), 1 ) . "' value='" . wp_specialchars( urldecode($v), 1 ) . "' />\n"; 
     247                        } 
     248                        $html .= "\t\t<input type='hidden' name='_wpnonce' value='" . wp_create_nonce($action) . "' />\n"; 
     249                        $html .= "\t\t<p>" . __('Are you sure you want to do this?') . "</p>\n\t\t<p><a href='$adminurl'>No</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t</form>\n"; 
     250                } else { 
     251                        $html .= "\t<p>" . __('Are you sure you want to do this?') . "</p>\n\t\t<p><a href='$adminurl'>No</a> <a href='" . add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] ) . "'>" . __('Yes') . "</a></p>\n"; 
     252                } 
     253                $html .= "</body>\n</html>"; 
     254 
     255                die($html); 
     256        } 
    236257        do_action('check_admin_referer'); 
    237 } 
    238 endif; 
     258}endif; 
    239259 
    240260if ( !function_exists('check_ajax_referer') ) : 
    241261function check_ajax_referer() { 
    … …  
    460480} 
    461481endif; 
    462482 
     483if ( !function_exists('wp_verify_nonce') ) : 
     484function wp_verify_nonce($nonce, $action = -1) { 
     485        $user = wp_get_current_user(); 
     486        $uid = $user->id; 
     487 
     488        $i = ceil(time() / 43200); 
     489 
     490        //Allow for expanding range, but only do one check if we can 
     491        if( substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10) == $nonce || substr(md5(($i - 1) . DB_PASSWORD . $action . $uid), -12, 10) == $nonce ) 
     492                return true; 
     493        return false; 
     494} 
     495endif; 
     496 
     497if ( !function_exists('wp_create_nonce') ) : 
     498function wp_create_nonce($action = -1) { 
     499        $user = wp_get_current_user(); 
     500        $uid = $user->id; 
     501 
     502        $i = ceil(time() / 43200); 
     503         
     504        return substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10); 
     505} 
     506endif; 
     507 
    463508?> 

  • wp-admin/inline-uploading.php

     
    22 
    33require_once('admin.php'); 
    44 
    5 check_admin_referer(); 
     5check_admin_referer('inlineuploading'); 
    66 
    77header('Content-Type: text/html; charset=' . get_option('blog_charset')); 
    88 
    … …  
    4141 
    4242wp_delete_attachment($attachment); 
    4343 
    44 header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=$start"); 
     44header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=$start", 'inlineuploading')); 
    4545die; 
    4646 
    4747case 'save': 
    … …  
    100100        add_post_meta($id, '_wp_attachment_metadata', array()); 
    101101} 
    102102 
    103 header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=0"); 
     103header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=0", 'inlineuploading')); 
    104104die(); 
    105105 
    106106case 'upload': 
    … …  
    139139$attachments = $wpdb->get_results("SELECT ID, post_date, post_title, post_mime_type, guid FROM $wpdb->posts WHERE post_type = 'attachment' $and_type $and_post $and_user ORDER BY $sort LIMIT $start, $double", ARRAY_A); 
    140140 
    141141if ( count($attachments) == 0 ) { 
    142         header("Location: ".basename(__FILE__)."?post=$post&action=upload"); 
     142        header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&action=upload", 'inlineuploading') ); 
    143143        die; 
    144144} elseif ( count($attachments) > $num ) { 
    145145        $next = $start + count($attachments) - $num; 

  • wp-admin/edit-comments.php

     
    5151<p><a href="?mode=view"><?php _e('View Mode') ?></a> | <a href="?mode=edit"><?php _e('Mass Edit Mode') ?></a></p> 
    5252<?php 
    5353if ( !empty( $_POST['delete_comments'] ) ) : 
    54         check_admin_referer(); 
     54        check_admin_referer('bulk-comments'); 
    5555 
    5656        $i = 0; 
    5757        foreach ($_POST['delete_comments'] as $comment) : // Check the permissions on each 
    … …  
    119119<?php 
    120120if ( current_user_can('edit_post', $comment->comment_post_ID) ) { 
    121121        echo " <a href='comment.php?action=editcomment&amp;comment=".$comment->comment_ID."\'>" .  __('Edit') . '</a>'; 
    122         echo ' | <a href="comment.php?action=deletecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID . '" onclick="return deleteSomething( \'comment\', ' . $comment->comment_ID . ', \'' . sprintf(__("You are about to delete this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($comment->comment_author, 1)) . "' );\">" . __('Delete') . '</a> '; 
     122        echo ' | <a href="' . wp_nonce_url('comment.php?action=deletecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID, 'delete-comment' . $comment->comment_ID) . '" onclick="return deleteSomething( \'comment\', ' . $comment->comment_ID . ', \'' . sprintf(__("You are about to delete this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($comment->comment_author, 1)) . "' );\">" . __('Delete') . '</a> '; 
    123123        if ( ('none' != $comment_status) && ( current_user_can('moderate_comments') ) ) { 
    124                 echo '<span class="unapprove"> | <a href="comment.php?action=unapprovecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID . '" onclick="return dimSomething( \'comment\', ' . $comment->comment_ID . ', \'unapproved\' );">' . __('Unapprove') . '</a> </span>'; 
    125                 echo '<span class="approve"> | <a href="comment.php?action=approvecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID . '" onclick="return dimSomething( \'comment\', ' . $comment->comment_ID . ', \'unapproved\' );">' . __('Approve') . '</a> </span>'; 
     124                echo '<span class="unapprove"> | <a href="' . wp_nonce_url('comment.php?action=unapprovecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID, 'unapprove-comment' . $comment->comment_ID) . '" onclick="return dimSomething( \'comment\', ' . $comment->comment_ID . ', \'unapproved\' );">' . __('Unapprove') . '</a> </span>'; 
     125                echo '<span class="approve"> | <a href="' . wp_nonce_url('comment.php?action=approvecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID, 'approve-comment' . $comment->comment_ID) . '" onclick="return dimSomething( \'comment\', ' . $comment->comment_ID . ', \'unapproved\' );">' . __('Approve') . '</a> </span>'; 
    126126        } 
    127127        echo " | <a href=\"comment.php?action=deletecomment&amp;delete_type=spam&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return deleteSomething( 'comment-as-spam', $comment->comment_ID, '" . sprintf(__("You are about to mark as spam this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to mark as spam."), wp_specialchars( $comment->comment_author, 1 ))  . "' );\">" . __('Spam') . "</a> "; 
    128128} 
    … …  
    150150} elseif ('edit' == $mode) { 
    151151 
    152152        if ($comments) { 
    153                 echo '<form name="deletecomments" id="deletecomments" action="" method="post">  
    154                 <table width="100%" cellpadding="3" cellspacing="3"> 
     153                echo '<form name="deletecomments" id="deletecomments" action="" method="post"> '; 
     154                wp_nonce_field('bulk-comments'); 
     155                echo '<table width="100%" cellpadding="3" cellspacing="3"> 
    155156  <tr> 
    156157    <th scope="col">*</th> 
    157158    <th scope="col">' .  __('Name') . '</th> 

  • wp-admin/post.php

     
    2424switch($action) { 
    2525case 'postajaxpost': 
    2626case 'post': 
    27         check_admin_referer(); 
     27        check_admin_referer('add-post'); 
    2828         
    2929        $post_ID = 'post' == $action ? write_post() : edit_post(); 
    3030 
    … …  
    7878        break; 
    7979 
    8080case 'editattachment': 
    81         check_admin_referer(); 
    82  
    8381        $post_id = (int) $_POST['post_ID']; 
    8482 
     83        check_admin_referer('update-attachment' . $post_id); 
     84 
    8585        // Don't let these be changed 
    8686        unset($_POST['guid']); 
    8787        $_POST['post_type'] = 'attachment'; 
    … …  
    9696                add_post_meta($post_id, '_wp_attachment_metadata', $newmeta); 
    9797 
    9898case 'editpost': 
    99         check_admin_referer(); 
     99        $post_ID = (int) $_POST['post_ID']; 
     100        check_admin_referer('update-post' . $post_ID); 
    100101         
    101102        $post_ID = edit_post(); 
    102103 
    … …  
    121122        break; 
    122123 
    123124case 'delete': 
    124         check_admin_referer(); 
    125  
    126125        $post_id = (isset($_GET['post']))  ? intval($_GET['post']) : intval($_POST['post_ID']); 
     126        check_admin_referer('delete-post' . $post_id); 
    127127 
    128128        $post = & get_post($post_id); 
    129129 

  • wp-admin/admin-functions.php

     
    709709    <td><?php echo mysql2date('Y-m-d g:i a', $post->post_modified); ?></td>  
    710710        <td><a href="<?php the_permalink(); ?>" rel="permalink" class="edit"><?php _e('View'); ?></a></td> 
    711711    <td><?php if ( current_user_can('edit_page', $id) ) { echo "<a href='page.php?action=edit&amp;post=$id' class='edit'>" . __('Edit') . "</a>"; } ?></td>  
    712     <td><?php if ( current_user_can('edit_page', $id) ) { echo "<a href='page.php?action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'page', " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
     712    <td><?php if ( current_user_can('edit_page', $id) ) { echo "<a href='" . wp_nonce_url("page.php?action=delete&amp;post=$id", 'delete-page' . $id) .  "' class='delete' onclick=\"return deleteSomething( 'page', " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
    713713  </tr>  
    714714 
    715715<?php 

  • wp-admin/edit-page-form.php

     
    55<?php 
    66if (0 == $post_ID) { 
    77        $form_action = 'post'; 
     8        $nonce_action = 'add-page'; 
    89        $temp_ID = -1 * time(); 
    910        $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='$temp_ID' />"; 
    1011} else { 
    1112        $form_action = 'editpost'; 
     13        $nonce_action = 'update-page' . $post_ID; 
    1214        $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />"; 
    1315} 
    1416 
    … …  
    2325<form name="post" action="page.php" method="post" id="post"> 
    2426 
    2527<?php 
     28wp_nonce_field($nonce_action); 
     29 
    2630if (isset($mode) && 'bookmarklet' == $mode) { 
    2731    echo '<input type="hidden" name="mode" value="bookmarklet" />'; 
    2832} 
    … …  
    150154<?php 
    151155if (current_user_can('upload_files')) { 
    152156        $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID); 
    153         $uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID"; 
     157        $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading'); 
    154158        $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src); 
    155159        if ( false != $uploading_iframe_src ) 
    156160                echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>'; 

  • wp-admin/comment.php

     
    8989        break; 
    9090 
    9191case 'deletecomment': 
    92  
    93         check_admin_referer(); 
    94  
    9592        $comment = (int) $_REQUEST['comment']; 
     93        check_admin_referer('delete-comment' . $comment); 
     94 
    9695        $p = (int) $_REQUEST['p']; 
    9796        if ( isset($_REQUEST['noredir']) ) { 
    9897                $noredir = true; 
    … …  
    123122        break; 
    124123 
    125124case 'unapprovecomment': 
    126  
    127         check_admin_referer(); 
    128  
    129125        $comment = (int) $_GET['comment']; 
     126        check_admin_referer('unapprove-comment' . $comment); 
     127         
    130128        $p = (int) $_GET['p']; 
    131129        if (isset($_GET['noredir'])) { 
    132130                $noredir = true; 
    … …  
    151149        break; 
    152150 
    153151case 'approvecomment': 
    154  
    155         check_admin_referer(); 
    156  
    157152        $comment = (int) $_GET['comment']; 
     153        check_admin_referer('approve-comment' . $comment); 
     154 
    158155        $p = (int) $_GET['p']; 
    159156        if (isset($_GET['noredir'])) { 
    160157                $noredir = true; 
    … …  
    184181 
    185182case 'editedcomment': 
    186183 
    187         check_admin_referer(); 
     184        check_admin_referer('update-comment'); 
    188185 
    189186        edit_comment(); 
    190187 

  • wp-admin/options-general.php

     
    1010<div class="wrap"> 
    1111<h2><?php _e('General Options') ?></h2> 
    1212<form method="post" action="options.php">  
     13<?php wp_nonce_field('update-options') ?> 
    1314<table class="optiontable">  
    1415<tr valign="top">  
    1516<th scope="row"><?php _e('Weblog title:') ?></th>  

  • wp-admin/edit-link-form.php

     
    22if ( ! empty($link_id) ) { 
    33        $heading = __('Edit Bookmark'); 
    44        $submit_text = __('Save Changes &raquo;'); 
    5         $form = '<form name="editlink" id="editlink" method="post" action="link.php">';  
     5        $form = '<form name="editlink" id="editlink" method="post" action="link.php">'; 
     6        $nonce_action = 'update-bookmark' . $link_id; 
    67} else { 
    78        $heading = __('Create Bookmark'); 
    89        $submit_text = __('Add Bookmark &raquo;'); 
    910        $form = '<form name="addlink" id="addlink" method="post" action="link.php">'; 
     11        $nonce_action = 'add-bookmark'; 
    1012} 
    1113 
    1214function xfn_check($class, $value = '', $type = 'check') { 
    … …  
    3133<div class="wrap">  
    3234<h2><?php echo $heading ?></h2> 
    3335<?php echo $form ?> 
    34   
     36<?php wp_nonce_field($nonce_action); ?> 
     37 
    3538<div id="poststuff"> 
    3639<div id="moremeta"> 
    3740<div id="grabit" class="dbx-group"> 

  • wp-admin/options-misc.php

     
    1111<div class="wrap">  
    1212<h2><?php _e('Miscellaneous Options') ?></h2>  
    1313<form method="post" action="options.php"> 
    14  
     14<?php wp_nonce_field('update-options') ?> 
    1515<fieldset class="options"> 
    1616<legend><?php _e('Uploading'); ?></legend> 
    1717<table class="editform optiontable"> 

  • wp-admin/edit-form-comment.php

     
    66?> 
    77 
    88<form name="post" action="comment.php" method="post" id="post"> 
     9<?php wp_nonce_field('update-comment' . $comment->comment_ID) ?> 
    910<div class="wrap"> 
    1011<input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" /> 
    1112<input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' /> 

  • wp-admin/edit-form-advanced.php

     
    2222        $form_action = 'post'; 
    2323        $temp_ID = -1 * time(); 
    2424        $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='$temp_ID' />"; 
     25        wp_nonce_field('add-post'); 
    2526} else { 
    2627        $form_action = 'editpost'; 
    2728        $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />"; 
     29        wp_nonce_field('update-post' .  $post_ID); 
    2830} 
    2931 
    3032$form_pingback = '<input type="hidden" name="post_pingback" value="' . get_option('default_pingback_flag') . '" id="post_pingback" />'; 
    … …  
    173175<?php 
    174176if (current_user_can('upload_files')) { 
    175177        $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID); 
    176         $uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID"; 
     178        $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading'); 
    177179        $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src); 
    178180        if ( false != $uploading_iframe_src ) 
    179181                echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>'; 

  • wp-admin/options-discussion.php

     
    2121<div class="wrap">  
    2222<h2><?php _e('Discussion Options') ?></h2>  
    2323<form method="post" action="options.php">  
     24<?php wp_nonce_field('update-options') ?> 
    2425<fieldset class="options"> 
    2526<legend><?php _e('Usual settings for an article:<br /><small><em>(These settings may be overridden for individual articles.)</em></small>') ?></legend>  
    2627<ul>  

  • wp-admin/edit.php

     
    211211 
    212212        case 'control_delete': 
    213213                ?> 
    214                 <td><?php if ( current_user_can('delete_post',$post->ID) ) { echo "<a href='post.php?action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'post', " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td> 
     214                <td><?php if ( current_user_can('delete_post',$post->ID) ) { echo "<a href='" . wp_nonce_url("post.php?action=delete&amp;post=$id", 'delete-post' . $post->ID) . "' class='delete' onclick=\"return deleteSomething( 'post', " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td> 
    215215                <?php 
    216216                break; 
    217217 

  • wp-admin/options.php

     
    2929case 'update': 
    3030        $any_changed = 0; 
    3131 
    32         check_admin_referer(); 
     32        check_admin_referer('update-options'); 
    3333 
    3434        if (!$_POST['page_options']) { 
    3535                foreach ($_POST as $key => $value) { 
    … …  
    8989<div class="wrap"> 
    9090  <h2><?php _e('All options'); ?></h2> 
    9191  <form name="form" action="options.php" method="post"> 
     92  <?php wp_nonce_field('update-options') ?> 
    9293  <input type="hidden" name="action" value="update" /> 
    9394  <table width="98%"> 
    9495<?php 

  • wp-admin/link.php

     
    2929 
    3030switch ($action) { 
    3131                case 'deletebookmarks' : 
    32                 check_admin_referer(); 
     32                check_admin_referer('bulk-bookmarks'); 
    3333 
    3434                // check the current user's level first. 
    3535                if (!current_user_can('manage_links')) 
    … …  
    5353                break; 
    5454 
    5555        case 'move' : 
    56                 check_admin_referer(); 
     56                check_admin_referer('bulk-bookmarks'); 
    5757 
    5858                // check the current user's level first. 
    5959                if (!current_user_can('manage_links')) 
    … …  
    7272                break; 
    7373 
    7474        case 'add' : 
    75                 check_admin_referer(); 
     75                check_admin_referer('add-bookmark'); 
    7676 
    7777                add_link(); 
    7878 
    … …  
    8080                break; 
    8181 
    8282        case 'save' : 
    83                 check_admin_referer(); 
    84  
    8583                $link_id = (int) $_POST['link_id']; 
     84                check_admin_referer('update-bookmark' . $link_id); 
     85 
    8686                edit_link($link_id); 
    8787 
    8888                wp_redirect($this_file); 
    … …  
    9090                break; 
    9191 
    9292        case 'delete' : 
    93                 check_admin_referer(); 
     93                $link_id = (int) $_GET['link_id']; 
     94                check_admin_referer('delete-bookmark' . $link_id); 
    9495 
    9596                if (!current_user_can('manage_links')) 
    9697                        die(__("Cheatin' uh ?")); 
    9798 
    98                 $link_id = (int) $_GET['link_id']; 
    99  
    10099                wp_delete_link($link_id); 
    101100 
    102101                wp_redirect($this_file); 

  • wp-admin/options-reading.php

     
    1010<div class="wrap">  
    1111<h2><?php _e('Reading Options') ?></h2>  
    1212<form name="form1" method="post" action="options.php"> 
     13<?php wp_nonce_field('update-options') ?> 
    1314 
    1415<?php if ( get_pages() ): ?> 
    1516<fieldset class="options">  

  • wp-admin/link-manager.php

     
    110110</form> 
    111111 
    112112<form id="links" method="post" action="link.php"> 
     113<?php wp_nonce_field('bulk-bookmarks') ?> 
    113114<input type="hidden" name="link_id" value="" /> 
    114115<input type="hidden" name="action" value="" /> 
    115116<input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" /> 
    … …  
    175176<?php 
    176177 
    177178                echo '<td><a href="link.php?link_id='.$link->link_id.'&amp;action=edit" class="edit">'.__('Edit').'</a></td>'; 
    178                 echo '<td><a href="link.php?link_id='.$link->link_id.'&amp;action=delete"'." class='delete' onclick=\"return deleteSomething( 'link', $link->link_id , '".sprintf(__("You are about to delete the &quot;%s&quot; bookmark to %s.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($link->link_name, 1), wp_specialchars($link->link_url)).'\' );" class="delete">'.__('Delete').'</a></td>'; 
     179                echo '<td><a href="' . wp_nonce_url('link.php?link_id='.$link->link_id.'&amp;action=delete', 'delete-bookmark' . $link->link_id ) . '"'." class='delete' onclick=\"return deleteSomething( 'link', $link->link_id , '".sprintf(__("You are about to delete the &quot;%s&quot; bookmark to %s.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($link->link_name, 1), wp_specialchars($link->link_url)).'\' );" class="delete">'.__('Delete').'</a></td>'; 
    179180                echo '<td align="center"><input type="checkbox" name="linkcheck[]" value="'.$link->link_id.'" /></td>'; 
    180181                echo "\n    </tr>\n"; 
    181182        } 

  • wp-admin/options-permalink.php

     
    5757 
    5858$home_path = get_home_path(); 
    5959 
    60 if ( isset($_POST) ) { 
    61         check_admin_referer(); 
     60if ( isset($_POST['permalink_structure']) || isset($_POST['category_base']) ) { 
     61        check_admin_referer('update-permalink'); 
    6262 
    6363        if ( isset($_POST['permalink_structure']) ) { 
    6464                $permalink_structure = $_POST['permalink_structure']; 
    … …  
    117117        ); 
    118118?> 
    119119<form name="form" action="options-permalink.php" method="post">  
     120<?php wp_nonce_field('update-permalink') ?> 
    120121<h3><?php _e('Common options:'); ?></h3> 
    121122<p> 
    122123        <label> 
    … …  
    165166<?php if ( $permalink_structure && !$usingpi && !$writable ) : ?> 
    166167  <p><?php _e('If your <code>.htaccess</code> file were <a href="http://codex.wordpress.org/Make_a_Directory_Writable">writable</a>, we could do this automatically, but it isn&#8217;t so these are the mod_rewrite rules you should have in your <code>.htaccess</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all.') ?></p> 
    167168<form action="options-permalink.php" method="post"> 
     169<?php wp_nonce_field('update-permalink') ?> 
    168170   <p> 
    169171<textarea rows="5" style="width: 98%;" name="rules"><?php echo $wp_rewrite->mod_rewrite_rules(); ?> 
    170172</textarea> 

  • wp-admin/page.php

     
    2424 
    2525switch($action) { 
    2626case 'post': 
    27  
     27        check_admin_referer('add-page'); 
    2828        $page_ID = write_post(); 
    2929 
    3030        // Redirect. 
    … …  
    7676 
    7777case 'editattachment': 
    7878        $page_id = $post_ID = (int) $_POST['post_ID']; 
     79        check_admin_referer('update-attachment' . $page_id); 
    7980 
    8081        // Don't let these be changed 
    8182        unset($_POST['guid']); 
    … …  
    9192                add_post_meta($page_id, '_wp_attachment_metadata', $newmeta); 
    9293 
    9394case 'editpost': 
     95        $page_ID = (int) $_POST['post_ID']; 
     96        check_admin_referer('update-page' . $page_ID); 
     97 
    9498        $page_ID = edit_post(); 
    9599 
    96100        if ($_POST['save']) { 
    … …  
    114118        break; 
    115119 
    116120case 'delete': 
    117         check_admin_referer(); 
    118  
    119121        $page_id = (isset($_GET['post']))  ? intval($_GET['post']) : intval($_POST['post_ID']); 
     122        check_admin_referer('delete-page' .  $page_id); 
    120123 
    121124        $page = & get_post($page_id); 
    122125 

  • wp-admin/options-writing.php

     
    1010<div class="wrap">  
    1111<h2><?php _e('Writing Options') ?></h2>  
    1212<form method="post" action="options.php">  
     13<?php wp_nonce_field('update-options') ?> 
    1314<table width="100%" cellspacing="2" cellpadding="5" class="editform">  
    1415<tr valign="top">  
    1516<th width="33%" scope="row"> <?php _e('Size of the post box:') ?></th>  

  • wp-admin/categories.php

     
    2424 
    2525case 'addcat': 
    2626 
    27         check_admin_referer(); 
     27        check_admin_referer('add-category'); 
    2828 
    2929        if ( !current_user_can('manage_categories') ) 
    3030                die (__('Cheatin&#8217; uh?')); 
    … …  
    3535break; 
    3636 
    3737case 'delete': 
     38        $cat_ID = (int) $_GET['cat_ID']; 
     39        check_admin_referer('delete-category' .  $cat_ID); 
    3840 
    39         check_admin_referer(); 
    40  
    4141        if ( !current_user_can('manage_categories') ) 
    4242                die (__('Cheatin&#8217; uh?')); 
    4343 
    44         $cat_ID = (int) $_GET['cat_ID']; 
    4544        $cat_name = get_catname($cat_ID); 
    4645 
    4746        // Don't delete the default cats. 
    … …  
    6766<div class="wrap"> 
    6867 <h2><?php _e('Edit Category') ?></h2> 
    6968 <form name="editcat" action="categories.php" method="post"> 
     69          <?php wp_nonce_field('update-category' .  $category->cat_ID); ?> 
    7070          <table class="editform" width="100%" cellspacing="2" cellpadding="5"> 
    7171                <tr> 
    7272                  <th width="33%" scope="row" valign="top"><label for="cat_name"><?php _e('Category name:') ?></label></th> 
    … …  
    9999break; 
    100100 
    101101case 'editedcat': 
    102         check_admin_referer(); 
     102        $cat_ID = (int) $_POST['cat_ID']; 
     103        check_admin_referer('update-category' . $cat_ID); 
    103104 
    104105        if ( !current_user_can('manage_categories') ) 
    105106                die (__('Cheatin&#8217; uh?')); 
    … …  
    157158<div class="wrap"> 
    158159    <h2><?php _e('Add New Category') ?></h2> 
    159160    <form name="addcat" id="addcat" action="categories.php" method="post"> 
     161        <?php wp_nonce_field('add-category'); ?> 
    160162        <div class="alignleft"><?php _e('Name:') ?><br /> 
    161163        <input type="text" name="cat_name" id="cat_name" value="" /></p> 
    162164        <p><?php _e('Category parent:') ?><br />