<?php
/*
Plugin Name: Ticket #16449 Test
Description: Tests the patch on #16449
Version: 0.1
Author: Mark Jaquith
Author URI: http://coveredwebservices.com/
*/

class CWS_Check_Admin_Referer_Test_Plugin {

	function __construct() {
		add_action( 'admin_menu', array( $this, 'admin_menu' ) );
	}

	function admin_menu() {
		$hook = add_submenu_page( 'tools.php', 'check_admin_referer()', 'check_admin_referer()', 'manage_options', 'check-admin-referer-test', array( $this, 'display_tools_page' ) );
		add_action( 'load-' . $hook, array( $this, 'load_tools_page' ) );
	}

	function display_tools_page() {
?>
<div class="wrap">
<?php screen_icon(); ?>
<h2>check_admin_referer() Test</h2>
<p>First, apply <a href="http://core.trac.wordpress.org/attachment/ticket/16449/incorrect_referer_check.patch">this patch</a>.</p>
<?php $this->no_patch_message(); ?>
<p>This will test the use of <code>check_admin_referer()</code> used without a string passed as its first parameter. <strong>You should never do this in core, or a plugin, or a theme.</strong> Click the button below. If the test passes, you will get a message telling you as such. If you get an "Are you sure?" screen, then the test failed.</p>
<form action="" method="post">
<!-- Do not ever use a form without a nonce! -->
<input type="hidden" name="foo-bar" value="foo-bar" />
<p class="submit"><input  class="button-primary" type="submit" value="Test check_admin_referer()" /></p>
</form>
</div>
<?php
	}

	function load_tools_page() {
		if ( isset( $_POST ) && $_POST ) {
			check_admin_referer(); // DO NOT EVER CALL THIS WITHOUT A STRING PASSED TO IT!
			wp_redirect( add_query_arg( 'passed_test', '1' ) );
			exit();
		} elseif ( isset( $_GET['passed_test'] ) && $_GET['passed_test'] ) {
			add_action( 'admin_notices', array( $this, 'admin_notice' ) );
		}
	}

	function admin_notice() {
?>
	<div class="updated"><p>The test passed!</p></div>
<?php
	}

	function no_patch_message() {
		$pluggable = @file_get_contents( ABSPATH . WPINC . '/pluggable.php' );
		if ( !$pluggable ) {
			echo "<p><strong>I was not able to determine whether you have applied this patch.</strong></p>";
		} else {
			if ( strpos( $pluggable, 'if ( !$result && !(-1 == $action && strpos($referer, $adminurl) === 0) ) {' ) === false ) {
				echo "<p><strong>It does not appear that you have applied <a href='http://core.trac.wordpress.org/attachment/ticket/16449/incorrect_referer_check.patch'>the patch</a>. Please do so!</p>";
			} else {
				echo "<p><strong>You have applied the patch &mdash; test away!</strong></p>";
			}
		}
	}
}

new CWS_Check_Admin_Referer_Test_Plugin;