WordPress.org

Make WordPress Core

Ticket #23165: 23165-c-r24432.patch

File 23165-c-r24432.patch, 63.2 KB (added by bpetty, 21 months ago)
  • wp-admin/comment.php

    diff --git wp-admin/comment.php wp-admin/comment.php
    index de5483e..e88c310 100644
    if ( $comment->comment_approved != '0' ) { // if not unapproved 
    191191</tr> 
    192192</table> 
    193193 
    194 <?php wp_nonce_field( $nonce_action ); ?> 
     194<?php wp_nonce_field( array( 'action' => $nonce_action ) ); ?> 
    195195<input type='hidden' name='action' value='<?php echo esc_attr($formaction); ?>' /> 
    196196<input type='hidden' name='c' value='<?php echo esc_attr($comment->comment_ID); ?>' /> 
    197197<input type='hidden' name='noredir' value='1' /> 
  • wp-admin/custom-background.php

    diff --git wp-admin/custom-background.php wp-admin/custom-background.php
    index a924eca..8d29874 100644
    if ( get_background_image() ) { 
    223223<th scope="row"><?php _e('Remove Image'); ?></th> 
    224224<td> 
    225225<form method="post" action=""> 
    226 <?php wp_nonce_field('custom-background-remove', '_wpnonce-custom-background-remove'); ?> 
     226<?php wp_nonce_field( array( 'action' => 'custom-background-remove', 
     227                                                         'name' => '_wpnonce-custom-background-remove' ) ); ?> 
    227228<?php submit_button( __( 'Remove Background Image' ), 'button', 'remove-background', false ); ?><br/> 
    228229<?php _e('This will remove the background image. You will not be able to restore any customizations.') ?> 
    229230</form> 
    if ( get_background_image() ) { 
    237238<th scope="row"><?php _e('Restore Original Image'); ?></th> 
    238239<td> 
    239240<form method="post" action=""> 
    240 <?php wp_nonce_field('custom-background-reset', '_wpnonce-custom-background-reset'); ?> 
     241<?php wp_nonce_field( array( 'action' => 'custom-background-reset', 
     242                                                         'name' => '_wpnonce-custom-background-reset' ) ); ?> 
    241243<?php submit_button( __( 'Restore Original Image' ), 'button', 'reset-background', false ); ?><br/> 
    242244<?php _e('This will restore the original background image. You will not be able to restore any customizations.') ?> 
    243245</form> 
    if ( get_background_image() ) { 
    252254                <label for="upload"><?php _e( 'Choose an image from your computer:' ); ?></label><br /> 
    253255                <input type="file" id="upload" name="import" /> 
    254256                <input type="hidden" name="action" value="save" /> 
    255                 <?php wp_nonce_field( 'custom-background-upload', '_wpnonce-custom-background-upload' ); ?> 
     257                <?php wp_nonce_field( array( 'action' => 'custom-background-upload', 
     258                                                                         'name' => '_wpnonce-custom-background-upload' ) ); ?> 
    256259                <?php submit_button( __( 'Upload' ), 'button', 'submit', false ); ?> 
    257260        </p> 
    258261        <p> 
    if ( current_theme_supports( 'custom-background', 'default-color' ) ) 
    328331</tbody> 
    329332</table> 
    330333 
    331 <?php wp_nonce_field('custom-background'); ?> 
     334<?php wp_nonce_field( array( 'action' => 'custom-background' ) ); ?> 
    332335<?php submit_button( null, 'primary', 'save-background-options' ); ?> 
    333336</form> 
    334337 
  • wp-admin/custom-header.php

    diff --git wp-admin/custom-header.php wp-admin/custom-header.php
    index 1228843..f5e6618 100644
    class Custom_Image_Header { 
    517517                <label for="upload"><?php _e( 'Choose an image from your computer:' ); ?></label><br /> 
    518518                <input type="file" id="upload" name="import" /> 
    519519                <input type="hidden" name="action" value="save" /> 
    520                 <?php wp_nonce_field( 'custom-header-upload', '_wpnonce-custom-header-upload' ); ?> 
     520                <?php wp_nonce_field( array( 'action' => 'custom-header-upload', 
     521                                                                         'name' => '_wpnonce-custom-header-upload' ) ); ?> 
    521522                <?php submit_button( __( 'Upload' ), 'button', 'submit', false ); ?> 
    522523        </p> 
    523524        <?php 
    if ( current_theme_supports( 'custom-header', 'default-text-color' ) ) { 
    632633 
    633634do_action( 'custom_header_options' ); 
    634635 
    635 wp_nonce_field( 'custom-header-options', '_wpnonce-custom-header-options' ); ?> 
     636wp_nonce_field( array( 'action' => 'custom-header-options', 
     637                                           'name' => '_wpnonce-custom-header-options' ) ); ?> 
    636638 
    637639<?php submit_button( null, 'primary', 'save-header-options' ); ?> 
    638640</form> 
    wp_nonce_field( 'custom-header-options', '_wpnonce-custom-header-options' ); ?> 
    726728        <?php if ( empty( $_POST ) && isset( $_GET['file'] ) ) { ?> 
    727729        <input type="hidden" name="create-new-attachment" value="true" /> 
    728730        <?php } ?> 
    729         <?php wp_nonce_field( 'custom-header-crop-image' ) ?> 
     731        <?php wp_nonce_field( array( 'action' => 'custom-header-crop-image' ) ); ?> 
    730732 
    731733        <p class="submit"> 
    732734        <?php submit_button( __( 'Crop and Publish' ), 'primary', 'submit', false ); ?> 
  • wp-admin/edit-form-advanced.php

    diff --git wp-admin/edit-form-advanced.php wp-admin/edit-form-advanced.php
    index 3e485f2..3e1d40d 100644
    if ( isset( $post_new_file ) && current_user_can( $post_type_object->cap->create 
    317317</div> 
    318318 
    319319<form name="post" action="post.php" method="post" id="post"<?php do_action('post_edit_form_tag'); ?>> 
    320 <?php wp_nonce_field($nonce_action); ?> 
     320<?php wp_nonce_field( array( 'action' => $nonce_action ) ); ?> 
    321321<input type="hidden" id="user-id" name="user_ID" value="<?php echo (int) $user_ID ?>" /> 
    322322<input type="hidden" id="hiddenaction" name="action" value="<?php echo esc_attr( $form_action ) ?>" /> 
    323323<input type="hidden" id="originalaction" name="originalaction" value="<?php echo esc_attr( $form_action ) ?>" /> 
    if ( 'draft' != get_post_status( $post ) ) 
    334334 
    335335echo $form_extra; 
    336336 
    337 wp_nonce_field( 'autosave', 'autosavenonce', false ); 
    338 wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false ); 
    339 wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false ); 
     337wp_nonce_field( array( 'action'   => 'autosave', 
     338                                           'name'     => 'autosavenonce', 
     339                                           'id'       => 'autosavenonce', 
     340                                           'referrer' => false ) ); 
     341wp_nonce_field( array( 'action'   => 'meta-box-order', 
     342                                           'name'     => 'meta-box-order-nonce', 
     343                                           'referrer' => false ) ); 
     344wp_nonce_field( array( 'action'   => 'closedpostboxes', 
     345                                           'name'     => 'closedpostboxesnonce', 
     346                                           'id'       => 'closedpostboxesnonce', 
     347                                           'referrer' => false ) ); 
    340348?> 
    341349 
    342350<div id="poststuff"> 
    if ( $post_type_object->public && ! ( 'pending' == get_post_status( $post ) && ! 
    370378?> 
    371379</div> 
    372380<?php 
    373 wp_nonce_field( 'samplepermalink', 'samplepermalinknonce', false ); 
     381wp_nonce_field( array( 'action'   => 'samplepermalink', 
     382                                           'name'     => 'samplepermalinknonce', 
     383                                           'id'       => 'samplepermalinknonce', 
     384                                           'referrer' => false ) ); 
    374385?> 
    375386</div><!-- /titlediv --> 
    376387<?php 
  • wp-admin/edit-form-comment.php

    diff --git wp-admin/edit-form-comment.php wp-admin/edit-form-comment.php
    index d9a0523..17f9642 100644
    if ( !defined('ABSPATH') ) 
    1111        die('-1'); 
    1212?> 
    1313<form name="post" action="comment.php" method="post" id="post"> 
    14 <?php wp_nonce_field('update-comment_' . $comment->comment_ID) ?> 
     14<?php wp_nonce_field( array( 'action' => 'update-comment_' . $comment->comment_ID, 'id' => '_wpnonce' ) ); ?> 
    1515<div class="wrap"> 
    1616<?php screen_icon(); ?> 
    1717<h2><?php _e('Edit Comment'); ?></h2> 
    if ( !defined('ABSPATH') ) 
    6565<?php 
    6666        $quicktags_settings = array( 'buttons' => 'strong,em,link,block,del,ins,img,ul,ol,li,code,close' ); 
    6767        wp_editor( $comment->comment_content, 'content', array( 'media_buttons' => false, 'tinymce' => false, 'quicktags' => $quicktags_settings ) ); 
    68         wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false ); ?> 
     68        wp_nonce_field( array( 'action'   => 'closedpostboxes', 
     69                                                   'name'     => 'closedpostboxesnonce', 
     70                                                   'id'       => 'closedpostboxesnonce', 
     71                                                   'referrer' => false ) ); 
     72        ?> 
    6973</div> 
    7074</div><!-- /post-body-content --> 
    7175 
  • wp-admin/edit-link-form.php

    diff --git wp-admin/edit-link-form.php wp-admin/edit-link-form.php
    index 0aca6e7..fde1147 100644
    if ( !empty($form) ) 
    7171if ( !empty($link_added) ) 
    7272        echo $link_added; 
    7373 
    74 wp_nonce_field( $nonce_action ); 
    75 wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false ); 
    76 wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false ); ?> 
     74wp_nonce_field( array( 'action' => $nonce_action ) ); 
     75wp_nonce_field( array( 'action'   => 'closedpostboxes', 
     76                                           'name'     => 'closedpostboxesnonce', 
     77                                           'id'       => 'closedpostboxesnonce', 
     78                                           'referrer' => false ) ); 
     79wp_nonce_field( array( 'action'   => 'meta-box-order', 
     80                                           'name'     => 'meta-box-order-nonce', 
     81                                           'referrer' => false ) ); ?> 
    7782 
    7883<div id="poststuff"> 
    7984 
  • wp-admin/edit-tag-form.php

    diff --git wp-admin/edit-tag-form.php wp-admin/edit-tag-form.php
    index 034642a..d25c332 100644
    do_action($taxonomy . '_pre_edit_form', $tag, $taxonomy); ?> 
    3434<input type="hidden" name="action" value="editedtag" /> 
    3535<input type="hidden" name="tag_ID" value="<?php echo esc_attr($tag->term_id) ?>" /> 
    3636<input type="hidden" name="taxonomy" value="<?php echo esc_attr($taxonomy) ?>" /> 
    37 <?php wp_original_referer_field(true, 'previous'); wp_nonce_field('update-tag_' . $tag_ID); ?> 
     37<?php wp_original_referer_field(true, 'previous'); wp_nonce_field( array( 'action' => 'update-tag_' . $tag_ID ) ); ?> 
    3838        <table class="form-table"> 
    3939                <tr class="form-field form-required"> 
    4040                        <th scope="row" valign="top"><label for="name"><?php _ex('Name', 'Taxonomy Name'); ?></label></th> 
  • wp-admin/edit-tags.php

    diff --git wp-admin/edit-tags.php wp-admin/edit-tags.php
    index 8375202..8007aa8 100644
    if ( current_user_can($tax->cap->edit_terms) ) { 
    354354<input type="hidden" name="screen" value="<?php echo esc_attr($current_screen->id); ?>" /> 
    355355<input type="hidden" name="taxonomy" value="<?php echo esc_attr($taxonomy); ?>" /> 
    356356<input type="hidden" name="post_type" value="<?php echo esc_attr($post_type); ?>" /> 
    357 <?php wp_nonce_field('add-tag', '_wpnonce_add-tag'); ?> 
     357<?php wp_nonce_field( array( 'action' => 'add-tag', 
     358                                                         'name'   => '_wpnonce_add-tag' ) ); ?> 
    358359 
    359360<div class="form-field form-required"> 
    360361        <label for="tag-name"><?php _ex('Name', 'Taxonomy Name'); ?></label> 
  • wp-admin/includes/class-wp-comments-list-table.php

    diff --git wp-admin/includes/class-wp-comments-list-table.php wp-admin/includes/class-wp-comments-list-table.php
    index e7ea212..4ca9ab7 100644
    class WP_Comments_List_Table extends WP_List_Table { 
    231231                } 
    232232 
    233233                if ( ( 'spam' == $comment_status || 'trash' == $comment_status ) && current_user_can( 'moderate_comments' ) ) { 
    234                         wp_nonce_field( 'bulk-destroy', '_destroy_nonce' ); 
    235234                        $title = ( 'spam' == $comment_status ) ? esc_attr__( 'Empty Spam' ) : esc_attr__( 'Empty Trash' ); 
    236235                        submit_button( $title, 'apply', 'delete_all', false ); 
    237236                } 
    class WP_Comments_List_Table extends WP_List_Table { 
    273272        function display() { 
    274273                extract( $this->_args ); 
    275274 
    276                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' ); 
     275                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ), 
     276                                                           'name' => '_ajax_fetch_list_nonce' ) ); 
    277277 
    278278                $this->display_tablenav( 'top' ); 
    279279 
    class WP_Post_Comments_List_Table extends WP_Comments_List_Table { 
    543543        function display( $output_empty = false ) { 
    544544                extract( $this->_args ); 
    545545 
    546                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' ); 
     546                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ), 
     547                                                           'name' => '_ajax_fetch_list_nonce' ) ); 
    547548?> 
    548549<table class="<?php echo implode( ' ', $this->get_table_classes() ); ?>" cellspacing="0" style="display:none;"> 
    549550        <tbody id="the-comment-list"<?php if ( $singular ) echo " data-wp-lists='list:$singular'"; ?>> 
  • wp-admin/includes/class-wp-list-table.php

    diff --git wp-admin/includes/class-wp-list-table.php wp-admin/includes/class-wp-list-table.php
    index 22c35f5..a969b9e 100644
    class WP_List_Table { 
    760760         */ 
    761761        function display_tablenav( $which ) { 
    762762                if ( 'top' == $which ) 
    763                         wp_nonce_field( 'bulk-' . $this->_args['plural'] ); 
     763                        wp_nonce_field( array( 'action' => 'bulk-' . $this->_args['plural'] ) ); 
    764764?> 
    765765        <div class="tablenav <?php echo esc_attr( $which ); ?>"> 
    766766 
  • wp-admin/includes/class-wp-posts-list-table.php

    diff --git wp-admin/includes/class-wp-posts-list-table.php wp-admin/includes/class-wp-posts-list-table.php
    index d14535e..f247c27 100644
    class WP_Posts_List_Table extends WP_List_Table { 
    10481048                <p class="submit inline-edit-save"> 
    10491049                        <a accesskey="c" href="#inline-edit" class="button-secondary cancel alignleft"><?php _e( 'Cancel' ); ?></a> 
    10501050                        <?php if ( ! $bulk ) { 
    1051                                 wp_nonce_field( 'inlineeditnonce', '_inline_edit', false ); 
     1051                                wp_nonce_field( array( 'action' => 'inlineeditnonce', 
     1052                                                                           'name' => '_inline_edit', 
     1053                                                                           'referrer' => false ) ); 
    10521054                                ?> 
    10531055                                <a accesskey="s" href="#inline-edit" class="button-primary save alignright"><?php _e( 'Update' ); ?></a> 
    10541056                                <span class="spinner"></span> 
  • wp-admin/includes/class-wp-terms-list-table.php

    diff --git wp-admin/includes/class-wp-terms-list-table.php wp-admin/includes/class-wp-terms-list-table.php
    index eef7ccf..e84264e 100644
    class WP_Terms_List_Table extends WP_List_Table { 
    365365                        <a accesskey="s" href="#inline-edit" class="save button-primary alignright"><?php echo $tax->labels->update_item; ?></a> 
    366366                        <span class="spinner"></span> 
    367367                        <span class="error" style="display:none;"></span> 
    368                         <?php wp_nonce_field( 'taxinlineeditnonce', '_inline_edit', false ); ?> 
     368                        <?php wp_nonce_field( array( 'action' => 'taxinlineeditnonce', 
     369                                                                                 'name' => '_inline_edit', 
     370                                                                                 'referrer' => false ) ); ?> 
    369371                        <input type="hidden" name="taxonomy" value="<?php echo esc_attr( $this->screen->taxonomy ); ?>" /> 
    370372                        <input type="hidden" name="post_type" value="<?php echo esc_attr( $this->screen->post_type ); ?>" /> 
    371373                        <br class="clear" /> 
  • wp-admin/includes/class-wp-theme-install-list-table.php

    diff --git wp-admin/includes/class-wp-theme-install-list-table.php wp-admin/includes/class-wp-theme-install-list-table.php
    index 8a46199..45fcaec 100644
    class WP_Theme_Install_List_Table extends WP_Themes_List_Table { 
    127127        } 
    128128 
    129129        function display() { 
    130                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' ); 
     130                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ), 
     131                                                           'name' => '_ajax_fetch_list_nonce' ) ); 
    131132?> 
    132133                <div class="tablenav top themes"> 
    133134                        <div class="alignleft actions"> 
  • wp-admin/includes/class-wp-themes-list-table.php

    diff --git wp-admin/includes/class-wp-themes-list-table.php wp-admin/includes/class-wp-themes-list-table.php
    index 684bd8b..a7e1442 100644
    class WP_Themes_List_Table extends WP_List_Table { 
    9898        } 
    9999 
    100100        function display() { 
    101                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' ); 
     101                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ), 
     102                                                           'name' => '_ajax_fetch_list_nonce' ) ); 
    102103?> 
    103104                <?php $this->tablenav( 'top' ); ?> 
    104105 
  • wp-admin/includes/dashboard.php

    diff --git wp-admin/includes/dashboard.php wp-admin/includes/dashboard.php
    index 657402f..0c9c661 100644
    function wp_add_dashboard_widget( $widget_id, $widget_name, $callback, $control_ 
    183183function _wp_dashboard_control_callback( $dashboard, $meta_box ) { 
    184184        echo '<form action="" method="post" class="dashboard-widget-control-form">'; 
    185185        wp_dashboard_trigger_widget_control( $meta_box['id'] ); 
    186         wp_nonce_field( 'edit-dashboard-widget_' . $meta_box['id'], 'dashboard-widget-nonce' ); 
     186        wp_nonce_field( array( 'action' => 'edit-dashboard-widget_' . $meta_box['id'], 
     187                                                   'name' => 'dashboard-widget-nonce' ) ); 
    187188        echo '<input type="hidden" name="widget_id" value="' . esc_attr($meta_box['id']) . '" />'; 
    188189        submit_button( __('Submit') ); 
    189190        echo '</form>'; 
    function wp_dashboard() { 
    215216</div> 
    216217 
    217218<?php 
    218         wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false ); 
    219         wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false ); 
     219        wp_nonce_field( array( 'action' => 'closedpostboxes', 
     220                                                   'name' => 'closedpostboxesnonce', 
     221                                                   'id' => 'closedpostboxesnonce', 
     222                                                   'referrer' => false ) ); 
     223        wp_nonce_field( array( 'action'   => 'meta-box-order', 
     224                                                   'name'     => 'meta-box-order-nonce', 
     225                                                   'referrer' => false ) ); 
    220226 
    221227} 
    222228 
    function wp_dashboard_quick_press() { 
    557563                        <input type="hidden" name="action" id="quickpost-action" value="post-quickpress-save" /> 
    558564                        <input type="hidden" name="post_ID" value="<?php echo $post_ID; ?>" /> 
    559565                        <input type="hidden" name="post_type" value="post" /> 
    560                         <?php wp_nonce_field('add-post'); ?> 
     566                        <?php wp_nonce_field( array( 'action' => 'add-post' ) ); ?> 
    561567                        <?php submit_button( __( 'Save Draft' ), 'button', 'save', false, array( 'id' => 'save-post' ) ); ?> 
    562568                        <input type="reset" value="<?php esc_attr_e( 'Reset' ); ?>" class="button" /> 
    563569                        <br class="clear" /> 
  • wp-admin/includes/media.php

    diff --git wp-admin/includes/media.php wp-admin/includes/media.php
    index 91937c5..f9cb433 100644
    function media_upload_type_form($type = 'file', $errors = null, $id = null) { 
    16561656<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="<?php echo $type; ?>-form"> 
    16571657<?php submit_button( '', 'hidden', 'save', false ); ?> 
    16581658<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" /> 
    1659 <?php wp_nonce_field('media-form'); ?> 
     1659<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?> 
    16601660 
    16611661<h3 class="media-title"><?php _e('Add media files from your computer'); ?></h3> 
    16621662 
    function media_upload_type_url_form($type = null, $errors = null, $id = null) { 
    17201720 
    17211721<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="<?php echo $type; ?>-form"> 
    17221722<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" /> 
    1723 <?php wp_nonce_field('media-form'); ?> 
     1723<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?> 
    17241724 
    17251725<h3 class="media-title"><?php _e('Insert media from another website'); ?></h3> 
    17261726 
    jQuery(function($){ 
    18701870<a href="#" id="clear"><?php _ex('Clear', 'verb'); ?></a> 
    18711871</div> 
    18721872<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="gallery-form"> 
    1873 <?php wp_nonce_field('media-form'); ?> 
     1873<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?> 
    18741874<?php //media_upload_form( $errors ); ?> 
    18751875<table class="widefat" cellspacing="0"> 
    18761876<thead><tr> 
    foreach ($arc_result as $arc_row) { 
    21112111 
    21122112<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="library-form"> 
    21132113 
    2114 <?php wp_nonce_field('media-form'); ?> 
     2114<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?> 
    21152115<?php //media_upload_form( $errors ); ?> 
    21162116 
    21172117<script type="text/javascript"> 
  • wp-admin/includes/meta-boxes.php

    diff --git wp-admin/includes/meta-boxes.php wp-admin/includes/meta-boxes.php
    index 8fc4214..e19ba70 100644
    function post_categories_meta_box( $post, $box ) { 
    421421                                        </label> 
    422422                                        <?php wp_dropdown_categories( array( 'taxonomy' => $taxonomy, 'hide_empty' => 0, 'name' => 'new'.$taxonomy.'_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '&mdash; ' . $tax->labels->parent_item . ' &mdash;' ) ); ?> 
    423423                                        <input type="button" id="<?php echo $taxonomy; ?>-add-submit" data-wp-lists="add:<?php echo $taxonomy ?>checklist:<?php echo $taxonomy ?>-add" class="button category-add-submit" value="<?php echo esc_attr( $tax->labels->add_new_item ); ?>" /> 
    424                                         <?php wp_nonce_field( 'add-'.$taxonomy, '_ajax_nonce-add-'.$taxonomy, false ); ?> 
     424                                        <?php wp_nonce_field( array( 'action' => 'add-'.$taxonomy, 
     425                                                                                                 'name' => '_ajax_nonce-add-'.$taxonomy, 
     426                                                                                                 'referrer' => false ) ); ?> 
    425427                                        <span id="<?php echo $taxonomy; ?>-ajax-response"></span> 
    426428                                </p> 
    427429                        </div> 
    function post_comment_meta_box_thead($result) { 
    535537function post_comment_meta_box( $post ) { 
    536538        global $wpdb; 
    537539 
    538         wp_nonce_field( 'get-comments', 'add_comment_nonce', false ); 
     540        wp_nonce_field( array( 'action' => 'get-comments', 
     541                                                   'name' => 'add_comment_nonce', 
     542                                                   'referrer' => false ) ); 
    539543        ?> 
    540544        <p class="hide-if-no-js" id="add-new-comment"><a href="#commentstatusdiv" onclick="commentReply.addcomment(<?php echo $post->ID; ?>);return false;"><?php _e('Add comment'); ?></a></p> 
    541545        <?php 
    function link_categories_meta_box($link) { 
    753757                        <label class="screen-reader-text" for="newcat"><?php _e( '+ Add New Category' ); ?></label> 
    754758                        <input type="text" name="newcat" id="newcat" class="form-required form-input-tip" value="<?php esc_attr_e( 'New category name' ); ?>" aria-required="true" /> 
    755759                        <input type="button" id="link-category-add-submit" data-wp-lists="add:categorychecklist:link-category-add" class="button" value="<?php esc_attr_e( 'Add' ); ?>" /> 
    756                         <?php wp_nonce_field( 'add-link-category', '_ajax_nonce', false ); ?> 
     760                        <?php wp_nonce_field( array( 'action' => 'add-link-category', 
     761                                                                                 'name' => '_ajax_nonce', 
     762                                                                                 'referrer' => false ) ); ?> 
    757763                        <span id="category-ajax-response"></span> 
    758764                </p> 
    759765        </div> 
  • wp-admin/includes/plugin-install.php

    diff --git wp-admin/includes/plugin-install.php wp-admin/includes/plugin-install.php
    index 0c2cd8b..a14d08a 100644
    function install_plugins_upload( $page = 1 ) { 
    145145        <h4><?php _e('Install a plugin in .zip format'); ?></h4> 
    146146        <p class="install-help"><?php _e('If you have a plugin in a .zip format, you may install it by uploading it here.'); ?></p> 
    147147        <form method="post" enctype="multipart/form-data" class="wp-upload-form" action="<?php echo self_admin_url('update.php?action=upload-plugin'); ?>"> 
    148                 <?php wp_nonce_field( 'plugin-upload'); ?> 
     148                <?php wp_nonce_field( array( 'action' => 'plugin-upload' ) ); ?> 
    149149                <label class="screen-reader-text" for="pluginzip"><?php _e('Plugin zip file'); ?></label> 
    150150                <input type="file" id="pluginzip" name="pluginzip" /> 
    151151                <?php submit_button( __( 'Install Now' ), 'button', 'install-plugin-submit', false ); ?> 
  • wp-admin/includes/plugin.php

    diff --git wp-admin/includes/plugin.php wp-admin/includes/plugin.php
    index 1a9a7a6..b6c2feb 100644
    function remove_option_whitelist( $del_options, $options = '' ) { 
    17591759function settings_fields($option_group) { 
    17601760        echo "<input type='hidden' name='option_page' value='" . esc_attr($option_group) . "' />"; 
    17611761        echo '<input type="hidden" name="action" value="update" />'; 
    1762         wp_nonce_field("$option_group-options"); 
     1762        wp_nonce_field( array( 'action' => "$option_group-options" ) ); 
    17631763} 
  • wp-admin/includes/screen.php

    diff --git wp-admin/includes/screen.php wp-admin/includes/screen.php
    index 2ab5161..85a5c3f 100644
    final class WP_Screen { 
    991991                echo $this->_screen_settings; 
    992992 
    993993                ?> 
    994                 <div><?php wp_nonce_field( 'screen-options-nonce', 'screenoptionnonce', false ); ?></div> 
     994                <div><?php wp_nonce_field( array( 'action' => 'screen-options-nonce', 
     995                                                                                  'name' => 'screenoptionnonce', 
     996                                                                                  'referrer' => false ) ); ?></div> 
    995997                </form> 
    996998                </div> 
    997999                <?php 
  • wp-admin/includes/template.php

    diff --git wp-admin/includes/template.php wp-admin/includes/template.php
    index 9b2128e..28d1920 100644
    function wp_comment_reply($position = '1', $checkbox = false, $mode = 'single', 
    370370        <input type="hidden" name="checkbox" id="checkbox" value="<?php echo $checkbox ? 1 : 0; ?>" /> 
    371371        <input type="hidden" name="mode" id="mode" value="<?php echo esc_attr($mode); ?>" /> 
    372372        <?php 
    373                 wp_nonce_field( 'replyto-comment', '_ajax_nonce-replyto-comment', false ); 
     373                wp_nonce_field( array( 'action' => 'replyto-comment', 
     374                                                           'name' => '_ajax_nonce-replyto-comment', 
     375                                                           'referrer' => false ) ); 
    374376                if ( current_user_can( 'unfiltered_html' ) ) 
    375                         wp_nonce_field( 'unfiltered-html-comment', '_wp_unfiltered_html_comment', false ); 
     377                        wp_nonce_field( array( 'action' => 'unfiltered-html-comment', 
     378                                                                   'name' => '_wp_unfiltered_html_comment', 
     379                                                                   'referrer' => false ) ); 
    376380        ?> 
    377381<?php if ( $table_row ) : ?> 
    378382</td></tr></tbody></table> 
    function _list_meta_row( $entry, &$count ) { 
    492496        $r .= "\n\t\t"; 
    493497        $r .= get_submit_button( __( 'Update' ), 'updatemeta small', "meta-{$entry['meta_id']}-submit", false, array( 'data-wp-lists' => "add:the-list:meta-{$entry['meta_id']}::_ajax_nonce-add-meta=$update_nonce" ) ); 
    494498        $r .= "</div>"; 
    495         $r .= wp_nonce_field( 'change-meta', '_ajax_nonce', false, false ); 
     499        $r .= wp_nonce_field( array( 'action' => 'change-meta', // Where is this nonce field actually checked? Doesn't look like it's used anywhere. 
     500                                                                 'name' => '_ajax_nonce', 'id' => '_ajax_nonce', 
     501                                                                 'referrer' => false, 'echo' => false ) ); 
    496502        $r .= "</td>"; 
    497503 
    498504        $r .= "\n\t\t<td><label class='screen-reader-text' for='meta[{$entry['meta_id']}][value]'>" . __( 'Value' ) . "</label><textarea name='meta[{$entry['meta_id']}][value]' id='meta[{$entry['meta_id']}][value]' rows='2' cols='30'>{$entry['meta_value']}</textarea></td>\n\t</tr>"; 
    function meta_form() { 
    556562<div class="submit"> 
    557563<?php submit_button( __( 'Add Custom Field' ), 'secondary', 'addmeta', false, array( 'id' => 'newmeta-submit', 'data-wp-lists' => 'add:the-list:newmeta' ) ); ?> 
    558564</div> 
    559 <?php wp_nonce_field( 'add-meta', '_ajax_nonce-add-meta', false ); ?> 
     565<?php wp_nonce_field( array( 'action' => 'add-meta', 
     566                                                         'name' => '_ajax_nonce-add-meta', 
     567                                                         'referrer' => false ) ); ?> 
    560568</td></tr> 
    561569</tbody> 
    562570</table> 
    function find_posts_div($found_action = '') { 
    13371345                                <?php } ?> 
    13381346 
    13391347                                <input type="hidden" name="affected" id="affected" value="" /> 
    1340                                 <?php wp_nonce_field( 'find-posts', '_ajax_nonce', false ); ?> 
     1348                                <?php wp_nonce_field( array( 'action' => 'find-posts', 
     1349                                                                                         'name' => '_ajax_nonce', 
     1350                                                                                         'referrer' => false ) ); ?> 
    13411351                                <label class="screen-reader-text" for="find-posts-input"><?php _e( 'Search' ); ?></label> 
    13421352                                <input type="text" id="find-posts-input" name="ps" value="" /> 
    13431353                                <span class="spinner"></span> 
  • wp-admin/includes/theme-install.php

    diff --git wp-admin/includes/theme-install.php wp-admin/includes/theme-install.php
    index 63be1d7..3f8925f 100644
    function install_themes_upload($page = 1) { 
    139139<h4><?php _e('Install a theme in .zip format'); ?></h4> 
    140140<p class="install-help"><?php _e('If you have a theme in a .zip format, you may install it by uploading it here.'); ?></p> 
    141141<form method="post" enctype="multipart/form-data" class="wp-upload-form" action="<?php echo self_admin_url('update.php?action=upload-theme'); ?>"> 
    142         <?php wp_nonce_field( 'theme-upload'); ?> 
     142        <?php wp_nonce_field( array( 'action' => 'theme-upload' ) ); ?> 
    143143        <input type="file" name="themezip" /> 
    144144        <?php submit_button( __( 'Install Now' ), 'button', 'install-theme-submit', false ); ?> 
    145145</form> 
  • wp-admin/index.php

    diff --git wp-admin/index.php wp-admin/index.php
    index b476267..3a4e6b0 100644
    $today = current_time('mysql', 1); 
    118118                $classes .= ' hidden'; ?> 
    119119 
    120120        <div id="welcome-panel" class="<?php echo esc_attr( $classes ); ?>"> 
    121                 <?php wp_nonce_field( 'welcome-panel-nonce', 'welcomepanelnonce', false ); ?> 
     121                <?php wp_nonce_field( array( 'action'   => 'welcome-panel-nonce', 
     122                                                                         'name'     => 'welcomepanelnonce', 
     123                                                                         'referrer' => false ) ); ?> 
    122124                <a class="welcome-panel-close" href="<?php echo esc_url( admin_url( '?welcome=0' ) ); ?>"><?php _e( 'Dismiss' ); ?></a> 
    123125                <?php do_action( 'welcome_panel' ); ?> 
    124126        </div> 
  • wp-admin/js/common.js

    diff --git wp-admin/js/common.js wp-admin/js/common.js
    index cd9ede7..c5cc066 100644
    columns = { 
    3030                $.post(ajaxurl, { 
    3131                        action: 'hidden-columns', 
    3232                        hidden: hidden, 
    33                         screenoptionnonce: $('#screenoptionnonce').val(), 
     33                        screenoptionnonce: $('input[name="screenoptionnonce"]').val(), 
    3434                        page: pagenow 
    3535                }); 
    3636        }, 
  • wp-admin/js/dashboard.js

    diff --git wp-admin/js/dashboard.js wp-admin/js/dashboard.js
    index 50a17f8..d47c956 100644
    jQuery(document).ready( function($) { 
    88                        $.post( ajaxurl, { 
    99                                action: 'update-welcome-panel', 
    1010                                visible: visible, 
    11                                 welcomepanelnonce: $('#welcomepanelnonce').val() 
     11                                welcomepanelnonce: $('input[name="welcomepanelnonce"]').val() 
    1212                        }); 
    1313                }; 
    1414 
  • wp-admin/js/edit-comments.js

    diff --git wp-admin/js/edit-comments.js wp-admin/js/edit-comments.js
    index 038a1e5..531b1e8 100644
    setCommentsList = function() { 
    263263                args = $.extend(args, { 
    264264                        'action': 'fetch-list', 
    265265                        'list_args': list_args, 
    266                         '_ajax_fetch_list_nonce': $('#_ajax_fetch_list_nonce').val() 
     266                        '_ajax_fetch_list_nonce': $('input[name="_ajax_fetch_list_nonce"]').val() 
    267267                }); 
    268268 
    269269                $.ajax({ 
  • wp-admin/js/media.js

    diff --git wp-admin/js/media.js wp-admin/js/media.js
    index b4ed0fb..a3aabce 100644
    var findPosts; 
    4848                        var post = { 
    4949                                        ps: $('#find-posts-input').val(), 
    5050                                        action: 'find_posts', 
    51                                         _ajax_nonce: $('#_ajax_nonce').val() 
     51                                        _ajax_nonce: $('input[name="_ajax_nonce"]').val() 
    5252                                }, 
    5353                                spinner = $( '.find-box-search .spinner' ); 
    5454 
  • wp-admin/js/nav-menu.js

    diff --git wp-admin/js/nav-menu.js wp-admin/js/nav-menu.js
    index ee829da..21bbd1e 100644
    var wpNavMenu; 
    808808                attachThemeLocationsListeners : function() { 
    809809                        var loc = $('#nav-menu-theme-locations'), params = {}; 
    810810                        params['action'] = 'menu-locations-save'; 
    811                         params['menu-settings-column-nonce'] = $('#menu-settings-column-nonce').val(); 
     811                        params['menu-settings-column-nonce'] = $('input[name="menu-settings-column-nonce"]').val(); 
    812812                        loc.find('input[type="submit"]').click(function() { 
    813813                                loc.find('select').each(function() { 
    814814                                        params[this.name] = $(this).val(); 
    var wpNavMenu; 
    852852                                'action': 'menu-quick-search', 
    853853                                'response-format': 'markup', 
    854854                                'menu': $('#menu').val(), 
    855                                 'menu-settings-column-nonce': $('#menu-settings-column-nonce').val(), 
     855                                'menu-settings-column-nonce': $('input[name="menu-settings-column-nonce"]').val(), 
    856856                                'q': q, 
    857857                                'type': input.attr('name') 
    858858                        }; 
    var wpNavMenu; 
    899899 
    900900                addItemToMenu : function(menuItem, processMethod, callback) { 
    901901                        var menu = $('#menu').val(), 
    902                                 nonce = $('#menu-settings-column-nonce').val(); 
     902                                nonce = $('input[name="menu-settings-column-nonce"]').val(); 
    903903 
    904904                        processMethod = processMethod || function(){}; 
    905905                        callback = callback || function(){}; 
  • wp-admin/js/post.js

    diff --git wp-admin/js/post.js wp-admin/js/post.js
    index dd3a427..082080c 100644
    commentsBox = { 
    190190                data = { 
    191191                        'action' : 'get-comments', 
    192192                        'mode' : 'single', 
    193                         '_ajax_nonce' : $('#add_comment_nonce').val(), 
     193                        '_ajax_nonce' : $('input[name="add_comment_nonce"]').val(), 
    194194                        'p' : $('#post_ID').val(), 
    195195                        'start' : st, 
    196196                        'number' : num 
  • wp-admin/js/postbox.js

    diff --git wp-admin/js/postbox.js wp-admin/js/postbox.js
    index 838db5d..e4a9f37 100644
    var postboxes; 
    121121 
    122122                        postVars = { 
    123123                                action: 'meta-box-order', 
    124                                 _ajax_nonce: $('#meta-box-order-nonce').val(), 
     124                                _ajax_nonce: $('input[name="meta-box-order-nonce"]').val(), 
    125125                                page_columns: page_columns, 
    126126                                page: page 
    127127                        } 
  • wp-admin/js/theme.js

    diff --git wp-admin/js/theme.js wp-admin/js/theme.js
    index 079c73b..71bdb6d 100644
    jQuery( document ).ready( function($) { 
    123123 * @uses ajaxurl 
    124124 * @uses list_args 
    125125 * @uses theme_list_args 
    126  * @uses $('#_ajax_fetch_list_nonce').val() 
     126 * @uses $('input[name="_ajax_fetch_list_nonce"]').val()" 
    127127* */ 
    128128var ThemeScroller; 
    129129(function($){ 
    var ThemeScroller; 
    151151                        } 
    152152 
    153153                        // Handle inputs 
    154                         this.nonce = $('#_ajax_fetch_list_nonce').val(); 
     154                        this.nonce = $('input[name="_ajax_fetch_list_nonce"]').val(); 
    155155                        this.nextPage = ( theme_list_args.paged + 1 ); 
    156156 
    157157                        // Cache jQuery selectors 
  • wp-admin/js/widgets.js

    diff --git wp-admin/js/widgets.js wp-admin/js/widgets.js
    index 87be4dd..7b03f0e 100644
    wpWidgets = { 
    180180 
    181181                var a = { 
    182182                        action: 'widgets-order', 
    183                         savewidgets: $('#_wpnonce_widgets').val(), 
     183                        savewidgets: $('input[name="_wpnonce_widgets"]').val(), 
    184184                        sidebars: [] 
    185185                }; 
    186186 
    wpWidgets = { 
    203203 
    204204                a = { 
    205205                        action: 'save-widget', 
    206                         savewidgets: $('#_wpnonce_widgets').val(), 
     206                        savewidgets: $('input[name="_wpnonce_widgets"]').val(), 
    207207                        sidebar: sb 
    208208                }; 
    209209 
  • wp-admin/media-new.php

    diff --git wp-admin/media-new.php wp-admin/media-new.php
    index e428811..0c126b0 100644
    if ( get_user_setting('uploader') || isset( $_GET['browser-uploader'] ) ) 
    7676        var post_id = <?php echo $post_id; ?>, shortform = 3; 
    7777        </script> 
    7878        <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" /> 
    79         <?php wp_nonce_field('media-form'); ?> 
     79        <?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?> 
    8080        <div id="media-items" class="hide-if-no-js"></div> 
    8181        </form> 
    8282</div> 
  • wp-admin/media.php

    diff --git wp-admin/media.php wp-admin/media.php
    index 15d4323..df46a56 100644
    if ( current_user_can( 'upload_files' ) ) { ?> 
    128128<input type="hidden" name="attachment_id" id="attachment_id" value="<?php echo esc_attr($att_id); ?>" /> 
    129129<input type="hidden" name="action" value="editattachment" /> 
    130130<?php wp_original_referer_field(true, 'previous'); ?> 
    131 <?php wp_nonce_field('media-form'); ?> 
     131<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?> 
    132132 
    133133</form> 
    134134 
  • wp-admin/ms-delete-site.php

    diff --git wp-admin/ms-delete-site.php wp-admin/ms-delete-site.php
    index 7d772c2..823d5d4 100644
    Webmaster 
    7272        <p><?php _e( 'Remember, once deleted your site cannot be restored.' ) ?></p> 
    7373 
    7474        <form method="post" name="deletedirect"> 
    75                 <?php wp_nonce_field( 'delete-blog' ) ?> 
     75                <?php wp_nonce_field( array( 'action' => 'delete-blog' ) ); ?> 
    7676                <input type="hidden" name="action" value="deleteblog" /> 
    7777                <p><input id="confirmdelete" type="checkbox" name="confirmdelete" value="1" /> <label for="confirmdelete"><strong><?php printf( __( "I'm sure I want to permanently disable my site, and I am aware I can never get it back or use %s again." ), is_subdomain_install() ? $blog->domain : $blog->domain . $blog->path ); ?></strong></label></p> 
    7878                <?php submit_button( __( 'Delete My Site Permanently' ) ); ?> 
  • wp-admin/my-sites.php

    diff --git wp-admin/my-sites.php wp-admin/my-sites.php
    index 2ef4ca7..6738c00 100644
    else : 
    111111        }?> 
    112112        </table> 
    113113        <input type="hidden" name="action" value="updateblogsettings" /> 
    114         <?php wp_nonce_field( 'update-my-sites' ); ?> 
     114        <?php wp_nonce_field( array( 'action' => 'update-my-sites' ) ); ?> 
    115115        <?php submit_button(); ?> 
    116116        </form> 
    117117<?php endif; ?> 
  • wp-admin/nav-menus.php

    diff --git wp-admin/nav-menus.php wp-admin/nav-menus.php
    index 8e00908..0e191b0 100644
    require_once( './admin-header.php' ); 
    655655                <form id="nav-menu-meta" action="" class="nav-menu-meta" method="post" enctype="multipart/form-data"> 
    656656                        <input type="hidden" name="menu" id="nav-menu-meta-object-id" value="<?php echo esc_attr( $nav_menu_selected_id ); ?>" /> 
    657657                        <input type="hidden" name="action" value="add-menu-item" /> 
    658                         <?php wp_nonce_field( 'add-menu_item', 'menu-settings-column-nonce' ); ?> 
     658                        <?php wp_nonce_field( array( 'action' => 'add-menu_item', 
     659                                                                                 'name' => 'menu-settings-column-nonce' ) ); ?> 
    659660                        <?php do_accordion_sections( 'nav-menus', 'side', null ); ?> 
    660661                </form> 
    661662 
    require_once( './admin-header.php' ); 
    665666                        <form id="update-nav-menu" action="" method="post" enctype="multipart/form-data"> 
    666667                                <div class="menu-edit <?php if ( $add_new_screen ) echo 'blank-slate'; ?>"> 
    667668                                        <?php 
    668                                         wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false ); 
    669                                         wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false ); 
    670                                         wp_nonce_field( 'update-nav_menu', 'update-nav-menu-nonce' ); 
     669                                        wp_nonce_field( array( 'action' => 'closedpostboxes', 
     670                                                                                   'name' => 'closedpostboxesnonce', 
     671                                                                                   'id' => 'closedpostboxesnonce', 
     672                                                                                   'referrer' => false ) ); 
     673                                        wp_nonce_field( array( 'action'   => 'meta-box-order', 
     674                                                                                   'name'     => 'meta-box-order-nonce', 
     675                                                                                   'referrer' => false ) ); 
     676                                        wp_nonce_field( array( 'action' => 'update-nav_menu', 
     677                                                                                   'name' => 'update-nav-menu-nonce' ) ); 
    671678 
    672679                                        if ( $one_theme_location_no_menus ) { ?> 
    673680                                                <input type="hidden" name="zero-menu-state" value="true" /> 
  • wp-admin/network.php

    diff --git wp-admin/network.php wp-admin/network.php
    index 34ab517..045ab01 100644
    function network_step1( $errors = false ) { 
    172172 
    173173        echo '<form method="post" action="">'; 
    174174 
    175         wp_nonce_field( 'install-network-1' ); 
     175        wp_nonce_field( array( 'action' => 'install-network-1' ) ); 
    176176 
    177177        $error_codes = array(); 
    178178        if ( is_wp_error( $errors ) ) { 
  • wp-admin/network/settings.php

    diff --git wp-admin/network/settings.php wp-admin/network/settings.php
    index e745694..8f36434 100644
    if ( isset( $_GET['updated'] ) ) { 
    8383        <?php screen_icon('options-general'); ?> 
    8484        <h2><?php echo esc_html( $title ); ?></h2> 
    8585        <form method="post" action="settings.php"> 
    86                 <?php wp_nonce_field( 'siteoptions' ); ?> 
     86                <?php wp_nonce_field( array( 'action' => 'siteoptions' ) ); ?> 
    8787                <h3><?php _e( 'Operational Settings' ); ?></h3> 
    8888                <table class="form-table"> 
    8989                        <tr valign="top"> 
  • wp-admin/network/site-info.php

    diff --git wp-admin/network/site-info.php wp-admin/network/site-info.php
    index 7dd6aeb..4008ad3 100644
    if ( ! empty( $messages ) ) { 
    118118                echo '<div id="message" class="updated"><p>' . $msg . '</p></div>'; 
    119119} ?> 
    120120<form method="post" action="site-info.php?action=update-site"> 
    121         <?php wp_nonce_field( 'edit-site' ); ?> 
     121        <?php wp_nonce_field( array( 'action' => 'edit-site' ) ); ?> 
    122122        <input type="hidden" name="id" value="<?php echo esc_attr( $id ) ?>" /> 
    123123        <table class="form-table"> 
    124124                <tr class="form-field form-required"> 
  • wp-admin/network/site-new.php

    diff --git wp-admin/network/site-new.php wp-admin/network/site-new.php
    index 9fc5eef..cff37a4 100644
    if ( ! empty( $messages ) ) { 
    120120                echo '<div id="message" class="updated"><p>' . $msg . '</p></div>'; 
    121121} ?> 
    122122<form method="post" action="<?php echo network_admin_url('site-new.php?action=add-site'); ?>"> 
    123 <?php wp_nonce_field( 'add-blog', '_wpnonce_add-blog' ) ?> 
     123<?php wp_nonce_field( array( 'action' => 'add-blog', 
     124                                                         'name'   => '_wpnonce_add-blog' ) ); ?> 
    124125        <table class="form-table"> 
    125126                <tr class="form-field form-required"> 
    126127                        <th scope="row"><?php _e( 'Site Address' ) ?></th> 
  • wp-admin/network/site-settings.php

    diff --git wp-admin/network/site-settings.php wp-admin/network/site-settings.php
    index c3aec75..64fcf77 100644
    if ( ! empty( $messages ) ) { 
    104104                echo '<div id="message" class="updated"><p>' . $msg . '</p></div>'; 
    105105} ?> 
    106106<form method="post" action="site-settings.php?action=update-site"> 
    107         <?php wp_nonce_field( 'edit-site' ); ?> 
     107        <?php wp_nonce_field( array( 'action' => 'edit-site' ) ); ?> 
    108108        <input type="hidden" name="id" value="<?php echo esc_attr( $id ) ?>" /> 
    109109        <table class="form-table"> 
    110110                <?php 
  • wp-admin/network/site-users.php

    diff --git wp-admin/network/site-users.php wp-admin/network/site-users.php
    index 0812b50..ebfc85d 100644
    endif; ?> 
    267267                        </select></td> 
    268268                </tr> 
    269269        </table> 
    270         <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?> 
     270        <?php wp_nonce_field( array( 'action' => 'add-user', 
     271                                                                 'name'   => '_wpnonce_add-user' ) ); ?> 
    271272        <?php submit_button( __( 'Add User' ), 'primary', 'add-user', true, array( 'id' => 'submit-add-existing-user' ) ); ?> 
    272273</form> 
    273274<?php endif; ?> 
    endif; ?> 
    301302                        <td colspan="2"><?php _e( 'Username and password will be mailed to the above email address.' ) ?></td> 
    302303                </tr> 
    303304        </table> 
    304         <?php wp_nonce_field( 'add-user', '_wpnonce_add-new-user' ) ?> 
     305        <?php wp_nonce_field( array( 'action' => 'add-user', 
     306                                                                 'name'   => '_wpnonce_add-new-user' ) ); ?> 
    305307        <?php submit_button( __( 'Add New User' ), 'primary', 'add-user', true, array( 'id' => 'submit-add-user' ) ); ?> 
    306308</form> 
    307309<?php endif; ?> 
  • wp-admin/network/sites.php

    diff --git wp-admin/network/sites.php wp-admin/network/sites.php
    index 93341c3..0fd9532 100644
    if ( isset( $_GET['action'] ) ) { 
    7878                                        <input type="hidden" name="action" value="<?php echo esc_attr( $_GET['action2'] ) ?>" /> 
    7979                                        <input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" /> 
    8080                                        <input type="hidden" name="_wp_http_referer" value="<?php echo esc_attr( wp_get_referer() ); ?>" /> 
    81                                         <?php wp_nonce_field( $_GET['action2'], '_wpnonce', false ); ?> 
     81                                        <?php wp_nonce_field( array( 'action' => $_GET['action2'], 'referrer' => false ) ); ?> 
    8282                                        <p><?php echo esc_html( wp_unslash( $_GET['msg'] ) ); ?></p> 
    8383                                        <?php submit_button( __('Confirm'), 'button' ); ?> 
    8484                                </form> 
  • wp-admin/network/themes.php

    diff --git wp-admin/network/themes.php wp-admin/network/themes.php
    index 04840ee..e4a1a9b 100644
    if ( $action ) { 
    154154                                                foreach ( (array) $themes as $theme ) 
    155155                                                        echo '<input type="hidden" name="checked[]" value="' . esc_attr($theme) . '" />'; 
    156156                                        ?> 
    157                                         <?php wp_nonce_field('bulk-themes') ?> 
     157                                        <?php wp_nonce_field( array( 'action' => 'bulk-themes' ) ); ?> 
    158158                                        <?php submit_button( _n( 'Yes, Delete this theme', 'Yes, Delete these themes', $themes_to_delete ), 'button', 'submit', false ); ?> 
    159159                                </form> 
    160160                                <form method="post" action="<?php echo esc_url(wp_get_referer()); ?>" style="display:inline;"> 
  • wp-admin/network/user-new.php

    diff --git wp-admin/network/user-new.php wp-admin/network/user-new.php
    index 316fffe..45b5f12 100644
    if ( isset( $add_user_errors ) && is_wp_error( $add_user_errors ) ) { ?> 
    9999                        <td colspan="2"><?php _e( 'Username and password will be mailed to the above email address.' ) ?></td> 
    100100                </tr> 
    101101        </table> 
    102         <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?> 
     102        <?php wp_nonce_field( array( 'action' => 'add-user', 
     103                                                                 'name'   => '_wpnonce_add-user' ) ); ?> 
    103104        <?php submit_button( __('Add User'), 'primary', 'add-user' ); ?> 
    104105        </form> 
    105106</div> 
  • wp-admin/network/users.php

    diff --git wp-admin/network/users.php wp-admin/network/users.php
    index 1318355..fe5aaca 100644
    function confirm_delete_users( $users ) { 
    2828        <form action="users.php?action=dodelete" method="post"> 
    2929        <input type="hidden" name="dodelete" /> 
    3030        <?php 
    31         wp_nonce_field( 'ms-users-delete' ); 
     31        wp_nonce_field( array( 'action' => 'ms-users-delete' ) ); 
    3232        $site_admins = get_super_admins(); 
    3333        $admin_out = "<option value='$current_user->ID'>$current_user->user_login</option>"; 
    3434 
  • wp-admin/options-permalink.php

    diff --git wp-admin/options-permalink.php wp-admin/options-permalink.php
    index d086fdc..5735276 100644
    if ( ! is_multisite() ) { 
    170170<h2><?php echo esc_html( $title ); ?></h2> 
    171171 
    172172<form name="form" action="options-permalink.php" method="post"> 
    173 <?php wp_nonce_field('update-permalink') ?> 
     173<?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?> 
    174174 
    175175  <p><?php _e('By default WordPress uses web <abbr title="Universal Resource Locator">URL</abbr>s which have question marks and lots of numbers in them, however WordPress offers you the ability to create a custom URL structure for your permalinks and archives. This can improve the aesthetics, usability, and forward-compatibility of your links. A <a href="http://codex.wordpress.org/Using_Permalinks">number of tags are available</a>, and here are some examples to get you started.'); ?></p> 
    176176 
    printf( __('If you like, you may enter custom structures for your category and t 
    256256                if ( file_exists($home_path . 'web.config') ) : ?> 
    257257<p><?php _e('If your <code>web.config</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so this is the url rewrite rule you should have in your <code>web.config</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all. Then insert this rule inside of the <code>/&lt;configuration&gt;/&lt;system.webServer&gt;/&lt;rewrite&gt;/&lt;rules&gt;</code> element in <code>web.config</code> file.') ?></p> 
    258258<form action="options-permalink.php" method="post"> 
    259 <?php wp_nonce_field('update-permalink') ?> 
     259        <?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?> 
    260260        <p><textarea rows="9" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_textarea( $wp_rewrite->iis7_url_rewrite_rules() ); ?></textarea></p> 
    261261</form> 
    262262<p><?php _e('If you temporarily make your <code>web.config</code> file writable for us to generate rewrite rules automatically, do not forget to revert the permissions after rule has been saved.') ?></p> 
    263263                <?php else : ?> 
    264264<p><?php _e('If the root directory of your site were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so this is the url rewrite rule you should have in your <code>web.config</code> file. Create a new file, called <code>web.config</code> in the root directory of your site. Click in the field and press <kbd>CTRL + a</kbd> to select all. Then insert this code into the <code>web.config</code> file.') ?></p> 
    265265<form action="options-permalink.php" method="post"> 
    266 <?php wp_nonce_field('update-permalink') ?> 
     266        <?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?> 
    267267        <p><textarea rows="18" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_textarea( $wp_rewrite->iis7_url_rewrite_rules(true) ); ?></textarea></p> 
    268268</form> 
    269269<p><?php _e('If you temporarily make your site&#8217;s root directory writable for us to generate the <code>web.config</code> file automatically, do not forget to revert the permissions after the file has been created.') ?></p> 
    printf( __('If you like, you may enter custom structures for your category and t 
    273273        if ( $permalink_structure && ! $usingpi && ! $writable ) : ?> 
    274274<p><?php _e('If your <code>.htaccess</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so these are the mod_rewrite rules you should have in your <code>.htaccess</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all.') ?></p> 
    275275<form action="options-permalink.php" method="post"> 
    276 <?php wp_nonce_field('update-permalink') ?> 
     276        <?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?> 
    277277        <p><textarea rows="6" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_textarea( $wp_rewrite->mod_rewrite_rules() ); ?></textarea></p> 
    278278</form> 
    279279        <?php endif; ?> 
  • wp-admin/options.php

    diff --git wp-admin/options.php wp-admin/options.php
    index 80a0719..365de63 100644
    include('./admin-header.php'); ?> 
    178178<?php screen_icon(); ?> 
    179179  <h2><?php esc_html_e('All Settings'); ?></h2> 
    180180  <form name="form" action="options.php" method="post" id="all-options"> 
    181   <?php wp_nonce_field('options-options') ?> 
     181  <?php wp_nonce_field( array( 'action' => 'options-options' ) ); ?> 
    182182  <input type="hidden" name="action" value="update" /> 
    183183  <input type='hidden' name='option_page' value='options' /> 
    184184  <table class="form-table"> 
  • wp-admin/plugin-editor.php

    diff --git wp-admin/plugin-editor.php wp-admin/plugin-editor.php
    index 2167c1a..dc962a9 100644
    foreach ( $plugin_files as $plugin_file ) : 
    223223        </ul> 
    224224</div> 
    225225<form name="template" id="template" action="plugin-editor.php" method="post"> 
    226         <?php wp_nonce_field('edit-plugin_' . $file) ?> 
     226        <?php wp_nonce_field( array( 'action' => 'edit-plugin_' . $file ) ); ?> 
    227227                <div><textarea cols="70" rows="25" name="newcontent" id="newcontent" aria-describedby="newcontent-description"><?php echo $content; ?></textarea> 
    228228                <input type="hidden" name="action" value="update" /> 
    229229                <input type="hidden" name="file" value="<?php echo esc_attr($file) ?>" /> 
  • wp-admin/plugins.php

    diff --git wp-admin/plugins.php wp-admin/plugins.php
    index c371b64..ad35832 100644
    if ( $action ) { 
    294294                                                foreach ( (array) $plugins as $plugin ) 
    295295                                                        echo '<input type="hidden" name="checked[]" value="' . esc_attr($plugin) . '" />'; 
    296296                                        ?> 
    297                                         <?php wp_nonce_field('bulk-plugins') ?> 
     297                                        <?php wp_nonce_field( array( 'action' => 'bulk-plugins' ) ); ?> 
    298298                                        <?php submit_button( $data_to_delete ? __( 'Yes, Delete these files and data' ) : __( 'Yes, Delete these files' ), 'button', 'submit', false ); ?> 
    299299                                </form> 
    300300                                <form method="post" action="<?php echo esc_url(wp_get_referer()); ?>" style="display:inline;"> 
  • wp-admin/press-this.php

    diff --git wp-admin/press-this.php wp-admin/press-this.php
    index b270115..8838e16 100644
    $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( 
    443443<div id="poststuff" class="metabox-holder"> 
    444444        <div id="side-sortables" class="press-this-sidebar"> 
    445445                <div class="sleeve"> 
    446                         <?php wp_nonce_field('press-this') ?> 
     446                        <?php wp_nonce_field( array( 'action' => 'press-this' ) ); ?> 
    447447                        <input type="hidden" name="post_type" id="post_type" value="text"/> 
    448448                        <input type="hidden" name="autosave" id="autosave" /> 
    449449                        <input type="hidden" id="original_post_status" name="original_post_status" value="draft" /> 
    $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( 
    528528                                                                </label> 
    529529                                                                <?php wp_dropdown_categories( array( 'taxonomy' => 'category', 'hide_empty' => 0, 'name' => 'newcategory_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '&mdash; ' . $tax->labels->parent_item . ' &mdash;' ) ); ?> 
    530530                                                                <input type="button" id="category-add-submit" data-wp-lists="add:categorychecklist:category-add" class="button category-add-submit" value="<?php echo esc_attr( $tax->labels->add_new_item ); ?>" /> 
    531                                                                 <?php wp_nonce_field( 'add-category', '_ajax_nonce-add-category', false ); ?> 
     531                                                                <?php wp_nonce_field( array( 'action' => 'add-category', 
     532                                                                                                                         'name' => '_ajax_nonce-add-category', 
     533                                                                                                                         'referrer' => false ) ); ?> 
    532534                                                                <span id="category-ajax-response"></span> 
    533535                                                        </p> 
    534536                                                </div> 
  • wp-admin/theme-editor.php

    diff --git wp-admin/theme-editor.php wp-admin/theme-editor.php
    index 8f95cab..a2497c9 100644
    if ( $allowed_files ) : 
    198198        echo '<div class="error"><p>' . __('Oops, no such file exists! Double check the name and try again, merci.') . '</p></div>'; 
    199199else : ?> 
    200200        <form name="template" id="template" action="theme-editor.php" method="post"> 
    201         <?php wp_nonce_field( 'edit-theme_' . $file . $stylesheet ); ?> 
     201        <?php wp_nonce_field( array( 'action' => 'edit-theme_' . $file . $stylesheet ) ); ?> 
    202202                <div><textarea cols="70" rows="30" name="newcontent" id="newcontent" aria-describedby="newcontent-description"><?php echo $content; ?></textarea> 
    203203                <input type="hidden" name="action" value="update" /> 
    204204                <input type="hidden" name="file" value="<?php echo esc_attr( $relative_file ); ?>" /> 
  • wp-admin/update-core.php

    diff --git wp-admin/update-core.php wp-admin/update-core.php
    index c8f5877..38cbdb2 100644
    function list_core_update( $update ) { 
    6868        echo $message; 
    6969        echo '</p>'; 
    7070        echo '<form method="post" action="' . $form_action . '" name="upgrade" class="upgrade">'; 
    71         wp_nonce_field('upgrade-core'); 
     71        wp_nonce_field( array( 'action' => 'upgrade-core' ) ); 
    7272        echo '<p>'; 
    7373        echo '<input name="version" value="'. esc_attr($update->current) .'" type="hidden"/>'; 
    7474        echo '<input name="locale" value="'. esc_attr($update->locale) .'" type="hidden"/>'; 
    function list_plugin_updates() { 
    189189<h3><?php _e( 'Plugins' ); ?></h3> 
    190190<p><?php _e( 'The following plugins have new versions available. Check the ones you want to update and then click &#8220;Update Plugins&#8221;.' ); ?></p> 
    191191<form method="post" action="<?php echo esc_url( $form_action ); ?>" name="upgrade-plugins" class="upgrade"> 
    192 <?php wp_nonce_field('upgrade-core'); ?> 
     192<?php wp_nonce_field( array( 'action' => 'upgrade-core' ) ); ?> 
    193193<p><input id="upgrade-plugins" class="button" type="submit" value="<?php esc_attr_e('Update Plugins'); ?>" name="upgrade" /></p> 
    194194<table class="widefat" cellspacing="0" id="update-plugins-table"> 
    195195        <thead> 
    function list_theme_updates() { 
    267267<p><?php _e( 'The following themes have new versions available. Check the ones you want to update and then click &#8220;Update Themes&#8221;.' ); ?></p> 
    268268<p><?php printf( __('<strong>Please Note:</strong> Any customizations you have made to theme files will be lost. Please consider using <a href="%s">child themes</a> for modifications.'), _x('http://codex.wordpress.org/Child_Themes', 'Link used in suggestion to use child themes in GUU') ); ?></p> 
    269269<form method="post" action="<?php echo esc_url( $form_action ); ?>" name="upgrade-themes" class="upgrade"> 
    270 <?php wp_nonce_field('upgrade-core'); ?> 
     270<?php wp_nonce_field( array( 'action' => 'upgrade-core' ) ); ?> 
    271271<p><input id="upgrade-themes" class="button" type="submit" value="<?php esc_attr_e('Update Themes'); ?>" name="upgrade" /></p> 
    272272<table class="widefat" cellspacing="0" id="update-themes-table"> 
    273273        <thead> 
  • wp-admin/user-edit.php

    diff --git wp-admin/user-edit.php wp-admin/user-edit.php
    index 13a2f63..6e24098 100644
    if ( ! IS_PROFILE_PAGE ) { 
    190190</h2> 
    191191 
    192192<form id="your-profile" action="<?php echo esc_url( self_admin_url( IS_PROFILE_PAGE ? 'profile.php' : 'user-edit.php' ) ); ?>" method="post"<?php do_action('user_edit_form_tag'); ?>> 
    193 <?php wp_nonce_field('update-user_' . $user_id) ?> 
     193<?php wp_nonce_field( array( 'action' => 'update-user_' . $user_id ) ); ?> 
    194194<?php if ( $wp_http_referer ) : ?> 
    195195        <input type="hidden" name="wp_http_referer" value="<?php echo esc_url($wp_http_referer); ?>" /> 
    196196<?php endif; ?> 
  • wp-admin/user-new.php

    diff --git wp-admin/user-new.php wp-admin/user-new.php
    index 13a8e12..adf86d3 100644
    if ( is_multisite() ) { 
    268268?> 
    269269<form action="" method="post" name="adduser" id="adduser" class="validate"<?php do_action('user_new_form_tag');?>> 
    270270<input name="action" type="hidden" value="adduser" /> 
    271 <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?> 
     271<?php wp_nonce_field( array( 'action' => 'add-user', 
     272                                                         'name'   => '_wpnonce_add-user' ) ); ?> 
    272273 
    273274<table class="form-table"> 
    274275        <tr class="form-field form-required"> 
    if ( current_user_can( 'create_users') ) { 
    301302<p><?php _e('Create a brand new user and add it to this site.'); ?></p> 
    302303<form action="" method="post" name="createuser" id="createuser" class="validate"<?php do_action('user_new_form_tag');?>> 
    303304<input name="action" type="hidden" value="createuser" /> 
    304 <?php wp_nonce_field( 'create-user', '_wpnonce_create-user' ) ?> 
     305<?php wp_nonce_field( array( 'action' => 'create-user', 
     306                                                         'name' => '_wpnonce_create-user' ) ); ?> 
    305307<?php 
    306308// Load up the passed data, else set to a default. 
    307309foreach ( array( 'user_login' => 'login', 'first_name' => 'firstname', 'last_name' => 'lastname', 
  • wp-admin/users.php

    diff --git wp-admin/users.php wp-admin/users.php
    index e807487..da0003e 100644
    case 'delete': 
    214214        include ('admin-header.php'); 
    215215?> 
    216216<form action="" method="post" name="updateusers" id="updateusers"> 
    217 <?php wp_nonce_field('delete-users') ?> 
     217<?php wp_nonce_field( array( 'action' => 'delete-users' ) ); ?> 
    218218<?php echo $referer; ?> 
    219219 
    220220<div class="wrap"> 
    case 'remove': 
    319319        include ('admin-header.php'); 
    320320?> 
    321321<form action="" method="post" name="updateusers" id="updateusers"> 
    322 <?php wp_nonce_field('remove-users') ?> 
     322<?php wp_nonce_field( array( 'action' => 'remove-users' ) ); ?> 
    323323<?php echo $referer; ?> 
    324324 
    325325<div class="wrap"> 
  • wp-admin/widgets.php

    diff --git wp-admin/widgets.php wp-admin/widgets.php
    index 3e0b146..ecc1d37 100644
    if ( isset($_GET['editwidget']) && $_GET['editwidget'] ) { 
    281281        <input type="hidden" name="widget-id" class="widget-id" value="<?php echo esc_attr($widget_id); ?>" /> 
    282282        <input type="hidden" name="id_base" class="id_base" value="<?php echo esc_attr($id_base); ?>" /> 
    283283        <input type="hidden" name="multi_number" class="multi_number" value="<?php echo esc_attr($multi_number); ?>" /> 
    284 <?php   wp_nonce_field("save-delete-widget-$widget_id"); ?> 
     284        <?php wp_nonce_field( array( 'action' => "save-delete-widget-$widget_id" ) ); ?> 
    285285        <br class="clear" /> 
    286286        </div> 
    287287        </form> 
    foreach ( $wp_registered_sidebars as $sidebar => $registered_sidebar ) { 
    389389</div> 
    390390</div> 
    391391<form action="" method="post"> 
    392 <?php wp_nonce_field( 'save-sidebar-widgets', '_wpnonce_widgets', false ); ?> 
     392<?php wp_nonce_field( array( 'action' => 'save-sidebar-widgets', 
     393                                                         'name' => '_wpnonce_widgets', 
     394                                                         'referrer' => false ) ); ?> 
    393395</form> 
    394396<br class="clear" /> 
    395397</div> 
  • wp-includes/class-wp-editor.php

    diff --git wp-includes/class-wp-editor.php wp-includes/class-wp-editor.php
    index 71236ba..f68c992 100644
    final class _WP_Editors { 
    818818        ?> 
    819819        <div style="display:none;"> 
    820820        <form id="wp-link" tabindex="-1"> 
    821         <?php wp_nonce_field( 'internal-linking', '_ajax_linking_nonce', false ); ?> 
     821        <?php wp_nonce_field( array( 'action' => 'internal-linking', 
     822                                                                 'name' => '_ajax_linking_nonce', 
     823                                                                 'id' => '_ajax_linking_nonce', 
     824                                                                 'referrer' => false ) ); ?> 
    822825        <div id="link-selector"> 
    823826                <div id="link-options"> 
    824827                        <p class="howto"><?php _e( 'Enter the destination URL' ); ?></p> 
  • wp-includes/comment-template.php

    diff --git wp-includes/comment-template.php wp-includes/comment-template.php
    index 3d32132..362ce5e 100644
    function wp_comment_form_unfiltered_html_nonce() { 
    814814        $post_id = $post ? $post->ID : 0; 
    815815 
    816816        if ( current_user_can( 'unfiltered_html' ) ) { 
    817                 wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false ); 
     817                wp_nonce_field( array( 'action' => 'unfiltered-html-comment_' . $post_id, 
     818                                                           'name' => '_wp_unfiltered_html_comment_disabled', 
     819                                                           'id' => '_wp_unfiltered_html_comment_disabled', 
     820                                                           'referrer' => false ) ); 
    818821                echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n"; 
    819822        } 
    820823} 
  • wp-includes/functions.php

    diff --git wp-includes/functions.php wp-includes/functions.php
    index d31e58a..5012c33 100644
    function wp_nonce_url( $actionurl, $action = -1, $name = '_wpnonce' ) { 
    11861186 * offer absolute protection, but should protect against most cases. It is very 
    11871187 * important to use nonce field in forms. 
    11881188 * 
    1189  * The $action and $name are optional, but if you want to have better security, 
    1190  * it is strongly suggested to set those two parameters. It is easier to just 
     1189 * The following optional settings can be used with this method: 
     1190 * 
     1191 * action - A unique name included in the nonce hash (for better security). 
     1192 * name - The input field name, defaults to "_wpnonce". 
     1193 * id - Used as the input element id if desired. 
     1194 * referrer - Referrer field is used for validation, defaults to true. 
     1195 * echo - Output is displayed, defaults to true. Returns the output if false. 
     1196 * 
     1197 * While action is optional, it is strongly recommended to set this option to a 
     1198 * unique value for every form for better security. It is easier to just 
    11911199 * call the function without any parameters, because validation of the nonce 
    1192  * doesn't require any parameters, but since crackers know what the default is 
     1200 * doesn't require any parameters, but since crackers know what the default is, 
    11931201 * it won't be difficult for them to find a way around your nonce and cause 
    11941202 * damage. 
    11951203 * 
    1196  * The input name will be whatever $name value you gave. The input value will be 
    1197  * the nonce creation value. 
    1198  * 
    11991204 * @package WordPress 
    12001205 * @subpackage Security 
    12011206 * @since 2.0.4 
    12021207 * 
    1203  * @param string $action Optional. Action name. 
    1204  * @param string $name Optional. Nonce name. 
    1205  * @param bool $referer Optional, default true. Whether to set the referer field for validation. 
    1206  * @param bool $echo Optional, default true. Whether to display or return hidden form field. 
    1207  * @return string Nonce field. 
     1208 * @param array $options Optional settings for the nonce field, see description. 
     1209 * 
     1210 * @return string HTML nonce field to be used in a form. 
    12081211 */ 
    1209 function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) { 
    1210         $name = esc_attr( $name ); 
    1211         $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />'; 
     1212function wp_nonce_field( $options = array() ) { 
     1213        $defaults = array( 
     1214                'action'   => -1, 
     1215                'name'     => '_wpnonce', 
     1216                'id'       => '', 
     1217                'referrer' => true, 
     1218                'echo'     => true 
     1219        ); 
    12121220 
    1213         if ( $referer ) 
     1221        // WordPress 3.5 compatibility layer: 
     1222        // Arguments: $action = -1, $name = "_wpnonce", $referer = true, $echo = true 
     1223        // The $name parameter was also used for id. 
     1224        if ( ! is_array( $options ) || 0 == func_num_args() ) { 
     1225                _deprecated_argument( __FUNCTION__, '3.6', 'Please see the documentation on how to pass the necessary options to this function.' ); 
     1226                $old_args = func_get_args(); 
     1227                $options = array( 'name' => '_wpnonce' ); 
     1228                if ( isset( $old_args[0] ) ) $options['action']   = $old_args[0]; 
     1229                if ( isset( $old_args[1] ) ) $options['name']     = $old_args[1]; 
     1230                if ( isset( $old_args[2] ) ) $options['referrer'] = $old_args[2]; 
     1231                if ( isset( $old_args[3] ) ) $options['echo']     = $old_args[3]; 
     1232                $options['id'] = $options['name']; 
     1233        } 
     1234 
     1235        $options = wp_parse_args( $options, $defaults ); 
     1236 
     1237        $nonce_field = '<input type="hidden"'; 
     1238        if ( ! empty( $options['id'] ) ) { 
     1239                $nonce_field .= ' id="' . esc_attr( $options['id'] ) . '"'; 
     1240        } 
     1241        $nonce_field .= ' name="' . esc_attr( $options['name'] ) . '"'; 
     1242        $nonce_field .= ' value="' . esc_attr( wp_create_nonce( $options['action'] ) ) . '" />'; 
     1243 
     1244        if ( $options['referrer'] ) 
    12141245                $nonce_field .= wp_referer_field( false ); 
    12151246 
    1216         if ( $echo ) 
     1247        if ( $options['echo'] ) 
    12171248                echo $nonce_field; 
    12181249 
    12191250        return $nonce_field; 
  • wp-includes/ms-functions.php

    diff --git wp-includes/ms-functions.php wp-includes/ms-functions.php
    index 1037a9f..ff5780f 100644
    function upload_is_file_too_big( $upload ) { 
    15801580function signup_nonce_fields() { 
    15811581        $id = mt_rand(); 
    15821582        echo "<input type='hidden' name='signup_form_id' value='{$id}' />"; 
    1583         wp_nonce_field('signup_form_' . $id, '_signup_form', false); 
     1583        wp_nonce_field( array( 'action' => 'signup_form_' . $id, 
     1584                                                   'name'=> '_signup_form', 
     1585                                                   'referrer' => false ) ); 
    15841586} 
    15851587 
    15861588/**