Ticket #13383: msnonce.diff

wp-admin/ms-edit.php

@@ -141 +141 @@
                 exit();
         break;
         case 'addblog':
-                check_admin_referer( 'add-blog' );
+                check_admin_referer( 'add-blog', '_wpnonce_add-blog' );
 
                 if ( ! current_user_can( 'manage_sites' ) )
                         wp_die( __( 'You do not have permission to access this page.' ) );
@@ -325 +325 @@
 
         case 'allblogs':
                 if ( isset( $_POST['doaction']) || isset($_POST['doaction2'] ) ) {
-                        check_admin_referer( 'bulk-ms-sites' );
+                        check_admin_referer( 'bulk-ms-sites', '_wpnonce_bulk-ms-sites' );
 
                         if ( ! current_user_can( 'manage_sites' ) )
                                 wp_die( __( 'You do not have permission to access this page.' ) );
@@ -507 +507 @@
                         wp_die( __( 'You do not have permission to access this page.' ) );
 
                 if ( isset( $_POST['doaction']) || isset($_POST['doaction2'] ) ) {
-                        check_admin_referer( 'bulk-ms-users' );
+                        check_admin_referer( 'bulk-ms-users', '_wpnonce_bulk-ms-users' );
 
                         if ( $_GET['action'] != -1 || $_POST['action2'] != -1 )
                                 $doaction = $_POST['action'] != -1 ? $_POST['action'] : $_POST['action2'];
@@ -590 +590 @@
         break;
 
         case 'adduser':
-                check_admin_referer( 'add-user' );
+                check_admin_referer( 'add-user', '_wpnonce_add-user' );
                 if ( ! current_user_can( 'manage_network_users' ) )
                         wp_die( __( 'You do not have permission to access this page.' ) );
 

wp-admin/ms-sites.php

@@ -418 +418 @@
                                 <option value="notspam"><?php _ex( 'Not Spam', 'site' ); ?></option>
                         </select>
                         <input type="submit" value="<?php esc_attr_e( 'Apply' ); ?>" name="doaction" id="doaction" class="button-secondary action" />
-                        <?php wp_nonce_field( 'bulk-ms-sites' ); ?>
+                        <?php wp_nonce_field( 'bulk-ms-sites', '_wpnonce_bulk-ms-sites' ); ?>
                 </div>
 
                 <?php if ( $page_links ) { ?>
@@ -679 +679 @@
                 <div id="form-add-site" class="wrap">
                         <h3><?php _e( 'Add Site' ) ?></h3>
                         <form method="post" action="ms-edit.php?action=addblog">
-                                <?php wp_nonce_field( 'add-blog' ) ?>
+                                <?php wp_nonce_field( 'add-blog', '_wpnonce_add-blog' ) ?>
                                 <table class="form-table">
                                         <tr class="form-field form-required">
                                                 <th scope="row"><?php _e( 'Site Address' ) ?></th>

wp-admin/ms-users.php

@@ -134 +134 @@
                                         <option value="notspam"><?php _ex( 'Not Spam', 'user' ); ?></option>
                                 </select>
                                 <input type="submit" value="<?php esc_attr_e( 'Apply' ); ?>" name="doaction" id="doaction" class="button-secondary action" />
-                                <?php wp_nonce_field( 'bulk-ms-users' ); ?>
+                                <?php wp_nonce_field( 'bulk-ms-users', '_wpnonce_bulk-ms-users' ); ?>
                         </div>
 
                         <?php if ( $page_links ) { ?>
@@ -355 +355 @@
                 </tr>
         </table>
         <p class="submit">
-                <?php wp_nonce_field( 'add-user' ) ?>
+                <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?>
                 <input class="button" type="submit" value="<?php esc_attr_e( 'Add user' ) ?>" /></p>
         </form>
 </div>