Ticket #13224: 13224.patch

wp-admin/includes/plugin-install.php

@@ -439 +439 @@
                                 $update_file = $file;
                                 $version = $plugin->new_version;
                                 if ( current_user_can('update_plugins') )
-                                        $url = wp_nonce_url(admin_url('update.php?action=upgrade-plugin&plugin=' . $update_file), 'upgrade-plugin_' . $update_file);
+                                        $url = admin_url( wp_nonce_url( 'update.php', 'upgrade-plugin_' . $update_file) . '&action=upgrade-plugin&plugin=' . $update_file);
                                 break;
                         }
                 }
@@ -450 +450 @@
                         $installed_plugin = get_plugins('/' . $api->slug);
                         if ( empty($installed_plugin) ) {
                                 if ( current_user_can('install_plugins') )
-                                        $url = wp_nonce_url(admin_url('update.php?action=install-plugin&plugin=' . $api->slug), 'install-plugin_' . $api->slug);
+                                        $url = admin_url( wp_nonce_url( 'update.php', 'install-plugin_' . $api->slug ) . '&action=install-plugin&plugin=' . $api->slug );
                         } else {
                                 $key = array_shift( $key = array_keys($installed_plugin) ); //Use the first plugin regardless of the name, Could have issues for multiple-plugins in one directory if they share different version numbers
                                 if ( version_compare($api->version, $installed_plugin[ $key ]['Version'], '=') ){
@@ -470 +470 @@
                 } else {
                         // "install" & no directory with that slug
                         if ( current_user_can('install_plugins') )
-                                $url = wp_nonce_url(admin_url('update.php?action=install-plugin&plugin=' . $api->slug), 'install-plugin_' . $api->slug);
+                                $url = admin_url( wp_nonce_url( 'update.php', 'install-plugin_' . $api->slug ) . '&action=install-plugin&plugin=' . $api->slug );
                 }
         }