WordPress.org
Get WordPress

Make WordPress Core

Ticket #23165: 23165-c-r24432.patch

File 23165-c-r24432.patch, 63.2 KB (added by bpetty, 12 years ago)

  • wp-admin/comment.php 

    diff --git wp-admin/comment.php wp-admin/comment.php
index de5483e..e88c310 100644
    if ( $comment->comment_approved != '0' ) { // if not unapproved 
    191191</tr>
    192192</table>
    193193
    194 <?php wp_nonce_field( $nonce_action ); ?>
     194<?php wp_nonce_field( array( 'action' => $nonce_action ) ); ?>
    195195<input type='hidden' name='action' value='<?php echo esc_attr($formaction); ?>' />
    196196<input type='hidden' name='c' value='<?php echo esc_attr($comment->comment_ID); ?>' />
    197197<input type='hidden' name='noredir' value='1' />

  • wp-admin/custom-background.php 

    diff --git wp-admin/custom-background.php wp-admin/custom-background.php
index a924eca..8d29874 100644
    if ( get_background_image() ) { 
    223223<th scope="row"><?php _e('Remove Image'); ?></th>
    224224<td>
    225225<form method="post" action="">
    226 <?php wp_nonce_field('custom-background-remove', '_wpnonce-custom-background-remove'); ?>
     226<?php wp_nonce_field( array( 'action' => 'custom-background-remove',
     227                                                         'name' => '_wpnonce-custom-background-remove' ) ); ?>
    227228<?php submit_button( __( 'Remove Background Image' ), 'button', 'remove-background', false ); ?><br/>
    228229<?php _e('This will remove the background image. You will not be able to restore any customizations.') ?>
    229230</form>
    … … if ( get_background_image() ) { 
    237238<th scope="row"><?php _e('Restore Original Image'); ?></th>
    238239<td>
    239240<form method="post" action="">
    240 <?php wp_nonce_field('custom-background-reset', '_wpnonce-custom-background-reset'); ?>
     241<?php wp_nonce_field( array( 'action' => 'custom-background-reset',
     242                                                         'name' => '_wpnonce-custom-background-reset' ) ); ?>
    241243<?php submit_button( __( 'Restore Original Image' ), 'button', 'reset-background', false ); ?><br/>
    242244<?php _e('This will restore the original background image. You will not be able to restore any customizations.') ?>
    243245</form>
    … … if ( get_background_image() ) { 
    252254                <label for="upload"><?php _e( 'Choose an image from your computer:' ); ?></label><br />
    253255                <input type="file" id="upload" name="import" />
    254256                <input type="hidden" name="action" value="save" />
    255                 <?php wp_nonce_field( 'custom-background-upload', '_wpnonce-custom-background-upload' ); ?>
     257                <?php wp_nonce_field( array( 'action' => 'custom-background-upload',
     258                                                                         'name' => '_wpnonce-custom-background-upload' ) ); ?>
    256259                <?php submit_button( __( 'Upload' ), 'button', 'submit', false ); ?>
    257260        </p>
    258261        <p>
    … … if ( current_theme_supports( 'custom-background', 'default-color' ) ) 
    328331</tbody>
    329332</table>
    330333
    331 <?php wp_nonce_field('custom-background'); ?>
     334<?php wp_nonce_field( array( 'action' => 'custom-background' ) ); ?>
    332335<?php submit_button( null, 'primary', 'save-background-options' ); ?>
    333336</form>
    334337

  • wp-admin/custom-header.php 

    diff --git wp-admin/custom-header.php wp-admin/custom-header.php
index 1228843..f5e6618 100644
    class Custom_Image_Header { 
    517517                <label for="upload"><?php _e( 'Choose an image from your computer:' ); ?></label><br />
    518518                <input type="file" id="upload" name="import" />
    519519                <input type="hidden" name="action" value="save" />
    520                 <?php wp_nonce_field( 'custom-header-upload', '_wpnonce-custom-header-upload' ); ?>
     520                <?php wp_nonce_field( array( 'action' => 'custom-header-upload',
     521                                                                         'name' => '_wpnonce-custom-header-upload' ) ); ?>
    521522                <?php submit_button( __( 'Upload' ), 'button', 'submit', false ); ?>
    522523        </p>
    523524        <?php
    … … if ( current_theme_supports( 'custom-header', 'default-text-color' ) ) { 
    632633
    633634do_action( 'custom_header_options' );
    634635
    635 wp_nonce_field( 'custom-header-options', '_wpnonce-custom-header-options' ); ?>
     636wp_nonce_field( array( 'action' => 'custom-header-options',
     637                                           'name' => '_wpnonce-custom-header-options' ) ); ?>
    636638
    637639<?php submit_button( null, 'primary', 'save-header-options' ); ?>
    638640</form>
    … … wp_nonce_field( 'custom-header-options', '_wpnonce-custom-header-options' ); ?> 
    726728        <?php if ( empty( $_POST ) && isset( $_GET['file'] ) ) { ?>
    727729        <input type="hidden" name="create-new-attachment" value="true" />
    728730        <?php } ?>
    729         <?php wp_nonce_field( 'custom-header-crop-image' ) ?>
     731        <?php wp_nonce_field( array( 'action' => 'custom-header-crop-image' ) ); ?>
    730732
    731733        <p class="submit">
    732734        <?php submit_button( __( 'Crop and Publish' ), 'primary', 'submit', false ); ?>

  • wp-admin/edit-form-advanced.php 

    diff --git wp-admin/edit-form-advanced.php wp-admin/edit-form-advanced.php
index 3e485f2..3e1d40d 100644
    if ( isset( $post_new_file ) && current_user_can( $post_type_object->cap->create 
    317317</div>
    318318
    319319<form name="post" action="post.php" method="post" id="post"<?php do_action('post_edit_form_tag'); ?>>
    320 <?php wp_nonce_field($nonce_action); ?>
     320<?php wp_nonce_field( array( 'action' => $nonce_action ) ); ?>
    321321<input type="hidden" id="user-id" name="user_ID" value="<?php echo (int) $user_ID ?>" />
    322322<input type="hidden" id="hiddenaction" name="action" value="<?php echo esc_attr( $form_action ) ?>" />
    323323<input type="hidden" id="originalaction" name="originalaction" value="<?php echo esc_attr( $form_action ) ?>" />
    … … if ( 'draft' != get_post_status( $post ) ) 
    334334
    335335echo $form_extra;
    336336
    337 wp_nonce_field( 'autosave', 'autosavenonce', false );
    338 wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false );
    339 wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false );
     337wp_nonce_field( array( 'action'   => 'autosave',
     338                                           'name'     => 'autosavenonce',
     339                                           'id'       => 'autosavenonce',
     340                                           'referrer' => false ) );
     341wp_nonce_field( array( 'action'   => 'meta-box-order',
     342                                           'name'     => 'meta-box-order-nonce',
     343                                           'referrer' => false ) );
     344wp_nonce_field( array( 'action'   => 'closedpostboxes',
     345                                           'name'     => 'closedpostboxesnonce',
     346                                           'id'       => 'closedpostboxesnonce',
     347                                           'referrer' => false ) );
    340348?>
    341349
    342350<div id="poststuff">
    … … if ( $post_type_object->public && ! ( 'pending' == get_post_status( $post ) && ! 
    370378?>
    371379</div>
    372380<?php
    373 wp_nonce_field( 'samplepermalink', 'samplepermalinknonce', false );
     381wp_nonce_field( array( 'action'   => 'samplepermalink',
     382                                           'name'     => 'samplepermalinknonce',
     383                                           'id'       => 'samplepermalinknonce',
     384                                           'referrer' => false ) );
    374385?>
    375386</div><!-- /titlediv -->
    376387<?php

  • wp-admin/edit-form-comment.php 

    diff --git wp-admin/edit-form-comment.php wp-admin/edit-form-comment.php
index d9a0523..17f9642 100644
    if ( !defined('ABSPATH') ) 
    1111        die('-1');
    1212?>
    1313<form name="post" action="comment.php" method="post" id="post">
    14 <?php wp_nonce_field('update-comment_' . $comment->comment_ID) ?>
     14<?php wp_nonce_field( array( 'action' => 'update-comment_' . $comment->comment_ID, 'id' => '_wpnonce' ) ); ?>
    1515<div class="wrap">
    1616<?php screen_icon(); ?>
    1717<h2><?php _e('Edit Comment'); ?></h2>
    … … if ( !defined('ABSPATH') ) 
    6565<?php
    6666        $quicktags_settings = array( 'buttons' => 'strong,em,link,block,del,ins,img,ul,ol,li,code,close' );
    6767        wp_editor( $comment->comment_content, 'content', array( 'media_buttons' => false, 'tinymce' => false, 'quicktags' => $quicktags_settings ) );
    68         wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false ); ?>
     68        wp_nonce_field( array( 'action'   => 'closedpostboxes',
     69                                                   'name'     => 'closedpostboxesnonce',
     70                                                   'id'       => 'closedpostboxesnonce',
     71                                                   'referrer' => false ) );
     72        ?>
    6973</div>
    7074</div><!-- /post-body-content -->
    7175

  • wp-admin/edit-link-form.php 

    diff --git wp-admin/edit-link-form.php wp-admin/edit-link-form.php
index 0aca6e7..fde1147 100644
    if ( !empty($form) ) 
    7171if ( !empty($link_added) )
    7272        echo $link_added;
    7373
    74 wp_nonce_field( $nonce_action );
    75 wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false );
    76 wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false ); ?>
     74wp_nonce_field( array( 'action' => $nonce_action ) );
     75wp_nonce_field( array( 'action'   => 'closedpostboxes',
     76                                           'name'     => 'closedpostboxesnonce',
     77                                           'id'       => 'closedpostboxesnonce',
     78                                           'referrer' => false ) );
     79wp_nonce_field( array( 'action'   => 'meta-box-order',
     80                                           'name'     => 'meta-box-order-nonce',
     81                                           'referrer' => false ) ); ?>
    7782
    7883<div id="poststuff">
    7984

  • wp-admin/edit-tag-form.php 

    diff --git wp-admin/edit-tag-form.php wp-admin/edit-tag-form.php
index 034642a..d25c332 100644
    do_action($taxonomy . '_pre_edit_form', $tag, $taxonomy); ?> 
    3434<input type="hidden" name="action" value="editedtag" />
    3535<input type="hidden" name="tag_ID" value="<?php echo esc_attr($tag->term_id) ?>" />
    3636<input type="hidden" name="taxonomy" value="<?php echo esc_attr($taxonomy) ?>" />
    37 <?php wp_original_referer_field(true, 'previous'); wp_nonce_field('update-tag_' . $tag_ID); ?>
     37<?php wp_original_referer_field(true, 'previous'); wp_nonce_field( array( 'action' => 'update-tag_' . $tag_ID ) ); ?>
    3838        <table class="form-table">
    3939                <tr class="form-field form-required">
    4040                        <th scope="row" valign="top"><label for="name"><?php _ex('Name', 'Taxonomy Name'); ?></label></th>

  • wp-admin/edit-tags.php 

    diff --git wp-admin/edit-tags.php wp-admin/edit-tags.php
index 8375202..8007aa8 100644
    if ( current_user_can($tax->cap->edit_terms) ) { 
    354354<input type="hidden" name="screen" value="<?php echo esc_attr($current_screen->id); ?>" />
    355355<input type="hidden" name="taxonomy" value="<?php echo esc_attr($taxonomy); ?>" />
    356356<input type="hidden" name="post_type" value="<?php echo esc_attr($post_type); ?>" />
    357 <?php wp_nonce_field('add-tag', '_wpnonce_add-tag'); ?>
     357<?php wp_nonce_field( array( 'action' => 'add-tag',
     358                                                         'name'   => '_wpnonce_add-tag' ) ); ?>
    358359
    359360<div class="form-field form-required">
    360361        <label for="tag-name"><?php _ex('Name', 'Taxonomy Name'); ?></label>

  • wp-admin/includes/class-wp-comments-list-table.php 

    diff --git wp-admin/includes/class-wp-comments-list-table.php wp-admin/includes/class-wp-comments-list-table.php
index e7ea212..4ca9ab7 100644
    class WP_Comments_List_Table extends WP_List_Table { 
    231231                }
    232232
    233233                if ( ( 'spam' == $comment_status || 'trash' == $comment_status ) && current_user_can( 'moderate_comments' ) ) {
    234                         wp_nonce_field( 'bulk-destroy', '_destroy_nonce' );
    235234                        $title = ( 'spam' == $comment_status ) ? esc_attr__( 'Empty Spam' ) : esc_attr__( 'Empty Trash' );
    236235                        submit_button( $title, 'apply', 'delete_all', false );
    237236                }
    … … class WP_Comments_List_Table extends WP_List_Table { 
    273272        function display() {
    274273                extract( $this->_args );
    275274
    276                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
     275                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ),
     276                                                           'name' => '_ajax_fetch_list_nonce' ) );
    277277
    278278                $this->display_tablenav( 'top' );
    279279
    … … class WP_Post_Comments_List_Table extends WP_Comments_List_Table { 
    543543        function display( $output_empty = false ) {
    544544                extract( $this->_args );
    545545
    546                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
     546                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ),
     547                                                           'name' => '_ajax_fetch_list_nonce' ) );
    547548?>
    548549<table class="<?php echo implode( ' ', $this->get_table_classes() ); ?>" cellspacing="0" style="display:none;">
    549550        <tbody id="the-comment-list"<?php if ( $singular ) echo " data-wp-lists='list:$singular'"; ?>>

  • wp-admin/includes/class-wp-list-table.php 

    diff --git wp-admin/includes/class-wp-list-table.php wp-admin/includes/class-wp-list-table.php
index 22c35f5..a969b9e 100644
    class WP_List_Table { 
    760760         */
    761761        function display_tablenav( $which ) {
    762762                if ( 'top' == $which )
    763                         wp_nonce_field( 'bulk-' . $this->_args['plural'] );
     763                        wp_nonce_field( array( 'action' => 'bulk-' . $this->_args['plural'] ) );
    764764?>
    765765        <div class="tablenav <?php echo esc_attr( $which ); ?>">
    766766

  • wp-admin/includes/class-wp-posts-list-table.php 

    diff --git wp-admin/includes/class-wp-posts-list-table.php wp-admin/includes/class-wp-posts-list-table.php
index d14535e..f247c27 100644
    class WP_Posts_List_Table extends WP_List_Table { 
    10481048                <p class="submit inline-edit-save">
    10491049                        <a accesskey="c" href="#inline-edit" class="button-secondary cancel alignleft"><?php _e( 'Cancel' ); ?></a>
    10501050                        <?php if ( ! $bulk ) {
    1051                                 wp_nonce_field( 'inlineeditnonce', '_inline_edit', false );
     1051                                wp_nonce_field( array( 'action' => 'inlineeditnonce',
     1052                                                                           'name' => '_inline_edit',
     1053                                                                           'referrer' => false ) );
    10521054                                ?>
    10531055                                <a accesskey="s" href="#inline-edit" class="button-primary save alignright"><?php _e( 'Update' ); ?></a>
    10541056                                <span class="spinner"></span>

  • wp-admin/includes/class-wp-terms-list-table.php 

    diff --git wp-admin/includes/class-wp-terms-list-table.php wp-admin/includes/class-wp-terms-list-table.php
index eef7ccf..e84264e 100644
    class WP_Terms_List_Table extends WP_List_Table { 
    365365                        <a accesskey="s" href="#inline-edit" class="save button-primary alignright"><?php echo $tax->labels->update_item; ?></a>
    366366                        <span class="spinner"></span>
    367367                        <span class="error" style="display:none;"></span>
    368                         <?php wp_nonce_field( 'taxinlineeditnonce', '_inline_edit', false ); ?>
     368                        <?php wp_nonce_field( array( 'action' => 'taxinlineeditnonce',
     369                                                                                 'name' => '_inline_edit',
     370                                                                                 'referrer' => false ) ); ?>
    369371                        <input type="hidden" name="taxonomy" value="<?php echo esc_attr( $this->screen->taxonomy ); ?>" />
    370372                        <input type="hidden" name="post_type" value="<?php echo esc_attr( $this->screen->post_type ); ?>" />
    371373                        <br class="clear" />

  • wp-admin/includes/class-wp-theme-install-list-table.php 

    diff --git wp-admin/includes/class-wp-theme-install-list-table.php wp-admin/includes/class-wp-theme-install-list-table.php
index 8a46199..45fcaec 100644
    class WP_Theme_Install_List_Table extends WP_Themes_List_Table { 
    127127        }
    128128
    129129        function display() {
    130                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
     130                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ),
     131                                                           'name' => '_ajax_fetch_list_nonce' ) );
    131132?>
    132133                <div class="tablenav top themes">
    133134                        <div class="alignleft actions">

  • wp-admin/includes/class-wp-themes-list-table.php 

    diff --git wp-admin/includes/class-wp-themes-list-table.php wp-admin/includes/class-wp-themes-list-table.php
index 684bd8b..a7e1442 100644
    class WP_Themes_List_Table extends WP_List_Table { 
    9898        }
    9999
    100100        function display() {
    101                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
     101                wp_nonce_field( array( 'action' => 'fetch-list-' . get_class( $this ),
     102                                                           'name' => '_ajax_fetch_list_nonce' ) );
    102103?>
    103104                <?php $this->tablenav( 'top' ); ?>
    104105

  • wp-admin/includes/dashboard.php 

    diff --git wp-admin/includes/dashboard.php wp-admin/includes/dashboard.php
index 657402f..0c9c661 100644
    function wp_add_dashboard_widget( $widget_id, $widget_name, $callback, $control_ 
    183183function _wp_dashboard_control_callback( $dashboard, $meta_box ) {
    184184        echo '<form action="" method="post" class="dashboard-widget-control-form">';
    185185        wp_dashboard_trigger_widget_control( $meta_box['id'] );
    186         wp_nonce_field( 'edit-dashboard-widget_' . $meta_box['id'], 'dashboard-widget-nonce' );
     186        wp_nonce_field( array( 'action' => 'edit-dashboard-widget_' . $meta_box['id'],
     187                                                   'name' => 'dashboard-widget-nonce' ) );
    187188        echo '<input type="hidden" name="widget_id" value="' . esc_attr($meta_box['id']) . '" />';
    188189        submit_button( __('Submit') );
    189190        echo '</form>';
    … … function wp_dashboard() { 
    215216</div>
    216217
    217218<?php
    218         wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false );
    219         wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false );
     219        wp_nonce_field( array( 'action' => 'closedpostboxes',
     220                                                   'name' => 'closedpostboxesnonce',
     221                                                   'id' => 'closedpostboxesnonce',
     222                                                   'referrer' => false ) );
     223        wp_nonce_field( array( 'action'   => 'meta-box-order',
     224                                                   'name'     => 'meta-box-order-nonce',
     225                                                   'referrer' => false ) );
    220226
    221227}
    222228
    … … function wp_dashboard_quick_press() { 
    557563                        <input type="hidden" name="action" id="quickpost-action" value="post-quickpress-save" />
    558564                        <input type="hidden" name="post_ID" value="<?php echo $post_ID; ?>" />
    559565                        <input type="hidden" name="post_type" value="post" />
    560                         <?php wp_nonce_field('add-post'); ?>
     566                        <?php wp_nonce_field( array( 'action' => 'add-post' ) ); ?>
    561567                        <?php submit_button( __( 'Save Draft' ), 'button', 'save', false, array( 'id' => 'save-post' ) ); ?>
    562568                        <input type="reset" value="<?php esc_attr_e( 'Reset' ); ?>" class="button" />
    563569                        <br class="clear" />

  • wp-admin/includes/media.php 

    diff --git wp-admin/includes/media.php wp-admin/includes/media.php
index 91937c5..f9cb433 100644
    function media_upload_type_form($type = 'file', $errors = null, $id = null) { 
    16561656<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="<?php echo $type; ?>-form">
    16571657<?php submit_button( '', 'hidden', 'save', false ); ?>
    16581658<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
    1659 <?php wp_nonce_field('media-form'); ?>
     1659<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?>
    16601660
    16611661<h3 class="media-title"><?php _e('Add media files from your computer'); ?></h3>
    16621662
    … … function media_upload_type_url_form($type = null, $errors = null, $id = null) { 
    17201720
    17211721<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="<?php echo $type; ?>-form">
    17221722<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
    1723 <?php wp_nonce_field('media-form'); ?>
     1723<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?>
    17241724
    17251725<h3 class="media-title"><?php _e('Insert media from another website'); ?></h3>
    17261726
    … … jQuery(function($){ 
    18701870<a href="#" id="clear"><?php _ex('Clear', 'verb'); ?></a>
    18711871</div>
    18721872<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="gallery-form">
    1873 <?php wp_nonce_field('media-form'); ?>
     1873<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?>
    18741874<?php //media_upload_form( $errors ); ?>
    18751875<table class="widefat" cellspacing="0">
    18761876<thead><tr>
    … … foreach ($arc_result as $arc_row) { 
    21112111
    21122112<form enctype="multipart/form-data" method="post" action="<?php echo esc_url( $form_action_url ); ?>" class="<?php echo $form_class; ?>" id="library-form">
    21132113
    2114 <?php wp_nonce_field('media-form'); ?>
     2114<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?>
    21152115<?php //media_upload_form( $errors ); ?>
    21162116
    21172117<script type="text/javascript">

  • wp-admin/includes/meta-boxes.php 

    diff --git wp-admin/includes/meta-boxes.php wp-admin/includes/meta-boxes.php
index 8fc4214..e19ba70 100644
    function post_categories_meta_box( $post, $box ) { 
    421421                                        </label>
    422422                                        <?php wp_dropdown_categories( array( 'taxonomy' => $taxonomy, 'hide_empty' => 0, 'name' => 'new'.$taxonomy.'_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '&mdash; ' . $tax->labels->parent_item . ' &mdash;' ) ); ?>
    423423                                        <input type="button" id="<?php echo $taxonomy; ?>-add-submit" data-wp-lists="add:<?php echo $taxonomy ?>checklist:<?php echo $taxonomy ?>-add" class="button category-add-submit" value="<?php echo esc_attr( $tax->labels->add_new_item ); ?>" />
    424                                         <?php wp_nonce_field( 'add-'.$taxonomy, '_ajax_nonce-add-'.$taxonomy, false ); ?>
     424                                        <?php wp_nonce_field( array( 'action' => 'add-'.$taxonomy,
     425                                                                                                 'name' => '_ajax_nonce-add-'.$taxonomy,
     426                                                                                                 'referrer' => false ) ); ?>
    425427                                        <span id="<?php echo $taxonomy; ?>-ajax-response"></span>
    426428                                </p>
    427429                        </div>
    … … function post_comment_meta_box_thead($result) { 
    535537function post_comment_meta_box( $post ) {
    536538        global $wpdb;
    537539
    538         wp_nonce_field( 'get-comments', 'add_comment_nonce', false );
     540        wp_nonce_field( array( 'action' => 'get-comments',
     541                                                   'name' => 'add_comment_nonce',
     542                                                   'referrer' => false ) );
    539543        ?>
    540544        <p class="hide-if-no-js" id="add-new-comment"><a href="#commentstatusdiv" onclick="commentReply.addcomment(<?php echo $post->ID; ?>);return false;"><?php _e('Add comment'); ?></a></p>
    541545        <?php
    … … function link_categories_meta_box($link) { 
    753757                        <label class="screen-reader-text" for="newcat"><?php _e( '+ Add New Category' ); ?></label>
    754758                        <input type="text" name="newcat" id="newcat" class="form-required form-input-tip" value="<?php esc_attr_e( 'New category name' ); ?>" aria-required="true" />
    755759                        <input type="button" id="link-category-add-submit" data-wp-lists="add:categorychecklist:link-category-add" class="button" value="<?php esc_attr_e( 'Add' ); ?>" />
    756                         <?php wp_nonce_field( 'add-link-category', '_ajax_nonce', false ); ?>
     760                        <?php wp_nonce_field( array( 'action' => 'add-link-category',
     761                                                                                 'name' => '_ajax_nonce',
     762                                                                                 'referrer' => false ) ); ?>
    757763                        <span id="category-ajax-response"></span>
    758764                </p>
    759765        </div>

  • wp-admin/includes/plugin-install.php 

    diff --git wp-admin/includes/plugin-install.php wp-admin/includes/plugin-install.php
index 0c2cd8b..a14d08a 100644
    function install_plugins_upload( $page = 1 ) { 
    145145        <h4><?php _e('Install a plugin in .zip format'); ?></h4>
    146146        <p class="install-help"><?php _e('If you have a plugin in a .zip format, you may install it by uploading it here.'); ?></p>
    147147        <form method="post" enctype="multipart/form-data" class="wp-upload-form" action="<?php echo self_admin_url('update.php?action=upload-plugin'); ?>">
    148                 <?php wp_nonce_field( 'plugin-upload'); ?>
     148                <?php wp_nonce_field( array( 'action' => 'plugin-upload' ) ); ?>
    149149                <label class="screen-reader-text" for="pluginzip"><?php _e('Plugin zip file'); ?></label>
    150150                <input type="file" id="pluginzip" name="pluginzip" />
    151151                <?php submit_button( __( 'Install Now' ), 'button', 'install-plugin-submit', false ); ?>

  • wp-admin/includes/plugin.php 

    diff --git wp-admin/includes/plugin.php wp-admin/includes/plugin.php
index 1a9a7a6..b6c2feb 100644
    function remove_option_whitelist( $del_options, $options = '' ) { 
    17591759function settings_fields($option_group) {
    17601760        echo "<input type='hidden' name='option_page' value='" . esc_attr($option_group) . "' />";
    17611761        echo '<input type="hidden" name="action" value="update" />';
    1762         wp_nonce_field("$option_group-options");
     1762        wp_nonce_field( array( 'action' => "$option_group-options" ) );
    17631763}

  • wp-admin/includes/screen.php 

    diff --git wp-admin/includes/screen.php wp-admin/includes/screen.php
index 2ab5161..85a5c3f 100644
    final class WP_Screen { 
    991991                echo $this->_screen_settings;
    992992
    993993                ?>
    994                 <div><?php wp_nonce_field( 'screen-options-nonce', 'screenoptionnonce', false ); ?></div>
     994                <div><?php wp_nonce_field( array( 'action' => 'screen-options-nonce',
     995                                                                                  'name' => 'screenoptionnonce',
     996                                                                                  'referrer' => false ) ); ?></div>
    995997                </form>
    996998                </div>
    997999                <?php

  • wp-admin/includes/template.php 

    diff --git wp-admin/includes/template.php wp-admin/includes/template.php
index 9b2128e..28d1920 100644
    function wp_comment_reply($position = '1', $checkbox = false, $mode = 'single', 
    370370        <input type="hidden" name="checkbox" id="checkbox" value="<?php echo $checkbox ? 1 : 0; ?>" />
    371371        <input type="hidden" name="mode" id="mode" value="<?php echo esc_attr($mode); ?>" />
    372372        <?php
    373                 wp_nonce_field( 'replyto-comment', '_ajax_nonce-replyto-comment', false );
     373                wp_nonce_field( array( 'action' => 'replyto-comment',
     374                                                           'name' => '_ajax_nonce-replyto-comment',
     375                                                           'referrer' => false ) );
    374376                if ( current_user_can( 'unfiltered_html' ) )
    375                         wp_nonce_field( 'unfiltered-html-comment', '_wp_unfiltered_html_comment', false );
     377                        wp_nonce_field( array( 'action' => 'unfiltered-html-comment',
     378                                                                   'name' => '_wp_unfiltered_html_comment',
     379                                                                   'referrer' => false ) );
    376380        ?>
    377381<?php if ( $table_row ) : ?>
    378382</td></tr></tbody></table>
    … … function _list_meta_row( $entry, &$count ) { 
    492496        $r .= "\n\t\t";
    493497        $r .= get_submit_button( __( 'Update' ), 'updatemeta small', "meta-{$entry['meta_id']}-submit", false, array( 'data-wp-lists' => "add:the-list:meta-{$entry['meta_id']}::_ajax_nonce-add-meta=$update_nonce" ) );
    494498        $r .= "</div>";
    495         $r .= wp_nonce_field( 'change-meta', '_ajax_nonce', false, false );
     499        $r .= wp_nonce_field( array( 'action' => 'change-meta', // Where is this nonce field actually checked? Doesn't look like it's used anywhere.
     500                                                                 'name' => '_ajax_nonce', 'id' => '_ajax_nonce',
     501                                                                 'referrer' => false, 'echo' => false ) );
    496502        $r .= "</td>";
    497503
    498504        $r .= "\n\t\t<td><label class='screen-reader-text' for='meta[{$entry['meta_id']}][value]'>" . __( 'Value' ) . "</label><textarea name='meta[{$entry['meta_id']}][value]' id='meta[{$entry['meta_id']}][value]' rows='2' cols='30'>{$entry['meta_value']}</textarea></td>\n\t</tr>";
    … … function meta_form() { 
    556562<div class="submit">
    557563<?php submit_button( __( 'Add Custom Field' ), 'secondary', 'addmeta', false, array( 'id' => 'newmeta-submit', 'data-wp-lists' => 'add:the-list:newmeta' ) ); ?>
    558564</div>
    559 <?php wp_nonce_field( 'add-meta', '_ajax_nonce-add-meta', false ); ?>
     565<?php wp_nonce_field( array( 'action' => 'add-meta',
     566                                                         'name' => '_ajax_nonce-add-meta',
     567                                                         'referrer' => false ) ); ?>
    560568</td></tr>
    561569</tbody>
    562570</table>
    … … function find_posts_div($found_action = '') { 
    13371345                                <?php } ?>
    13381346
    13391347                                <input type="hidden" name="affected" id="affected" value="" />
    1340                                 <?php wp_nonce_field( 'find-posts', '_ajax_nonce', false ); ?>
     1348                                <?php wp_nonce_field( array( 'action' => 'find-posts',
     1349                                                                                         'name' => '_ajax_nonce',
     1350                                                                                         'referrer' => false ) ); ?>
    13411351                                <label class="screen-reader-text" for="find-posts-input"><?php _e( 'Search' ); ?></label>
    13421352                                <input type="text" id="find-posts-input" name="ps" value="" />
    13431353                                <span class="spinner"></span>

  • wp-admin/includes/theme-install.php 

    diff --git wp-admin/includes/theme-install.php wp-admin/includes/theme-install.php
index 63be1d7..3f8925f 100644
    function install_themes_upload($page = 1) { 
    139139<h4><?php _e('Install a theme in .zip format'); ?></h4>
    140140<p class="install-help"><?php _e('If you have a theme in a .zip format, you may install it by uploading it here.'); ?></p>
    141141<form method="post" enctype="multipart/form-data" class="wp-upload-form" action="<?php echo self_admin_url('update.php?action=upload-theme'); ?>">
    142         <?php wp_nonce_field( 'theme-upload'); ?>
     142        <?php wp_nonce_field( array( 'action' => 'theme-upload' ) ); ?>
    143143        <input type="file" name="themezip" />
    144144        <?php submit_button( __( 'Install Now' ), 'button', 'install-theme-submit', false ); ?>
    145145</form>

  • wp-admin/index.php 

    diff --git wp-admin/index.php wp-admin/index.php
index b476267..3a4e6b0 100644
    $today = current_time('mysql', 1); 
    118118                $classes .= ' hidden'; ?>
    119119
    120120        <div id="welcome-panel" class="<?php echo esc_attr( $classes ); ?>">
    121                 <?php wp_nonce_field( 'welcome-panel-nonce', 'welcomepanelnonce', false ); ?>
     121                <?php wp_nonce_field( array( 'action'   => 'welcome-panel-nonce',
     122                                                                         'name'     => 'welcomepanelnonce',
     123                                                                         'referrer' => false ) ); ?>
    122124                <a class="welcome-panel-close" href="<?php echo esc_url( admin_url( '?welcome=0' ) ); ?>"><?php _e( 'Dismiss' ); ?></a>
    123125                <?php do_action( 'welcome_panel' ); ?>
    124126        </div>

  • wp-admin/js/common.js 

    diff --git wp-admin/js/common.js wp-admin/js/common.js
index cd9ede7..c5cc066 100644
    columns = { 
    3030                $.post(ajaxurl, {
    3131                        action: 'hidden-columns',
    3232                        hidden: hidden,
    33                         screenoptionnonce: $('#screenoptionnonce').val(),
     33                        screenoptionnonce: $('input[name="screenoptionnonce"]').val(),
    3434                        page: pagenow
    3535                });
    3636        },

  • wp-admin/js/dashboard.js 

    diff --git wp-admin/js/dashboard.js wp-admin/js/dashboard.js
index 50a17f8..d47c956 100644
    jQuery(document).ready( function($) { 
    88                        $.post( ajaxurl, {
    99                                action: 'update-welcome-panel',
    1010                                visible: visible,
    11                                 welcomepanelnonce: $('#welcomepanelnonce').val()
     11                                welcomepanelnonce: $('input[name="welcomepanelnonce"]').val()
    1212                        });
    1313                };
    1414

  • wp-admin/js/edit-comments.js 

    diff --git wp-admin/js/edit-comments.js wp-admin/js/edit-comments.js
index 038a1e5..531b1e8 100644
    setCommentsList = function() { 
    263263                args = $.extend(args, {
    264264                        'action': 'fetch-list',
    265265                        'list_args': list_args,
    266                         '_ajax_fetch_list_nonce': $('#_ajax_fetch_list_nonce').val()
     266                        '_ajax_fetch_list_nonce': $('input[name="_ajax_fetch_list_nonce"]').val()
    267267                });
    268268
    269269                $.ajax({

  • wp-admin/js/media.js 

    diff --git wp-admin/js/media.js wp-admin/js/media.js
index b4ed0fb..a3aabce 100644
    var findPosts; 
    4848                        var post = {
    4949                                        ps: $('#find-posts-input').val(),
    5050                                        action: 'find_posts',
    51                                         _ajax_nonce: $('#_ajax_nonce').val()
     51                                        _ajax_nonce: $('input[name="_ajax_nonce"]').val()
    5252                                },
    5353                                spinner = $( '.find-box-search .spinner' );
    5454

  • wp-admin/js/nav-menu.js 

    diff --git wp-admin/js/nav-menu.js wp-admin/js/nav-menu.js
index ee829da..21bbd1e 100644
    var wpNavMenu; 
    808808                attachThemeLocationsListeners : function() {
    809809                        var loc = $('#nav-menu-theme-locations'), params = {};
    810810                        params['action'] = 'menu-locations-save';
    811                         params['menu-settings-column-nonce'] = $('#menu-settings-column-nonce').val();
     811                        params['menu-settings-column-nonce'] = $('input[name="menu-settings-column-nonce"]').val();
    812812                        loc.find('input[type="submit"]').click(function() {
    813813                                loc.find('select').each(function() {
    814814                                        params[this.name] = $(this).val();
    … … var wpNavMenu; 
    852852                                'action': 'menu-quick-search',
    853853                                'response-format': 'markup',
    854854                                'menu': $('#menu').val(),
    855                                 'menu-settings-column-nonce': $('#menu-settings-column-nonce').val(),
     855                                'menu-settings-column-nonce': $('input[name="menu-settings-column-nonce"]').val(),
    856856                                'q': q,
    857857                                'type': input.attr('name')
    858858                        };
    … … var wpNavMenu; 
    899899
    900900                addItemToMenu : function(menuItem, processMethod, callback) {
    901901                        var menu = $('#menu').val(),
    902                                 nonce = $('#menu-settings-column-nonce').val();
     902                                nonce = $('input[name="menu-settings-column-nonce"]').val();
    903903
    904904                        processMethod = processMethod || function(){};
    905905                        callback = callback || function(){};

  • wp-admin/js/post.js 

    diff --git wp-admin/js/post.js wp-admin/js/post.js
index dd3a427..082080c 100644
    commentsBox = { 
    190190                data = {
    191191                        'action' : 'get-comments',
    192192                        'mode' : 'single',
    193                         '_ajax_nonce' : $('#add_comment_nonce').val(),
     193                        '_ajax_nonce' : $('input[name="add_comment_nonce"]').val(),
    194194                        'p' : $('#post_ID').val(),
    195195                        'start' : st,
    196196                        'number' : num

  • wp-admin/js/postbox.js 

    diff --git wp-admin/js/postbox.js wp-admin/js/postbox.js
index 838db5d..e4a9f37 100644
    var postboxes; 
    121121
    122122                        postVars = {
    123123                                action: 'meta-box-order',
    124                                 _ajax_nonce: $('#meta-box-order-nonce').val(),
     124                                _ajax_nonce: $('input[name="meta-box-order-nonce"]').val(),
    125125                                page_columns: page_columns,
    126126                                page: page
    127127                        }

  • wp-admin/js/theme.js 

    diff --git wp-admin/js/theme.js wp-admin/js/theme.js
index 079c73b..71bdb6d 100644
    jQuery( document ).ready( function($) { 
    123123 * @uses ajaxurl
    124124 * @uses list_args
    125125 * @uses theme_list_args
    126  * @uses $('#_ajax_fetch_list_nonce').val()
     126 * @uses $('input[name="_ajax_fetch_list_nonce"]').val()"
    127127* */
    128128var ThemeScroller;
    129129(function($){
    … … var ThemeScroller; 
    151151                        }
    152152
    153153                        // Handle inputs
    154                         this.nonce = $('#_ajax_fetch_list_nonce').val();
     154                        this.nonce = $('input[name="_ajax_fetch_list_nonce"]').val();
    155155                        this.nextPage = ( theme_list_args.paged + 1 );
    156156
    157157                        // Cache jQuery selectors

  • wp-admin/js/widgets.js 

    diff --git wp-admin/js/widgets.js wp-admin/js/widgets.js
index 87be4dd..7b03f0e 100644
    wpWidgets = { 
    180180
    181181                var a = {
    182182                        action: 'widgets-order',
    183                         savewidgets: $('#_wpnonce_widgets').val(),
     183                        savewidgets: $('input[name="_wpnonce_widgets"]').val(),
    184184                        sidebars: []
    185185                };
    186186
    … … wpWidgets = { 
    203203
    204204                a = {
    205205                        action: 'save-widget',
    206                         savewidgets: $('#_wpnonce_widgets').val(),
     206                        savewidgets: $('input[name="_wpnonce_widgets"]').val(),
    207207                        sidebar: sb
    208208                };
    209209

  • wp-admin/media-new.php 

    diff --git wp-admin/media-new.php wp-admin/media-new.php
index e428811..0c126b0 100644
    if ( get_user_setting('uploader') || isset( $_GET['browser-uploader'] ) ) 
    7676        var post_id = <?php echo $post_id; ?>, shortform = 3;
    7777        </script>
    7878        <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
    79         <?php wp_nonce_field('media-form'); ?>
     79        <?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?>
    8080        <div id="media-items" class="hide-if-no-js"></div>
    8181        </form>
    8282</div>

  • wp-admin/media.php 

    diff --git wp-admin/media.php wp-admin/media.php
index 15d4323..df46a56 100644
    if ( current_user_can( 'upload_files' ) ) { ?> 
    128128<input type="hidden" name="attachment_id" id="attachment_id" value="<?php echo esc_attr($att_id); ?>" />
    129129<input type="hidden" name="action" value="editattachment" />
    130130<?php wp_original_referer_field(true, 'previous'); ?>
    131 <?php wp_nonce_field('media-form'); ?>
     131<?php wp_nonce_field( array( 'action' => 'media-form' ) ); ?>
    132132
    133133</form>
    134134

  • wp-admin/ms-delete-site.php 

    diff --git wp-admin/ms-delete-site.php wp-admin/ms-delete-site.php
index 7d772c2..823d5d4 100644
    Webmaster 
    7272        <p><?php _e( 'Remember, once deleted your site cannot be restored.' ) ?></p>
    7373
    7474        <form method="post" name="deletedirect">
    75                 <?php wp_nonce_field( 'delete-blog' ) ?>
     75                <?php wp_nonce_field( array( 'action' => 'delete-blog' ) ); ?>
    7676                <input type="hidden" name="action" value="deleteblog" />
    7777                <p><input id="confirmdelete" type="checkbox" name="confirmdelete" value="1" /> <label for="confirmdelete"><strong><?php printf( __( "I'm sure I want to permanently disable my site, and I am aware I can never get it back or use %s again." ), is_subdomain_install() ? $blog->domain : $blog->domain . $blog->path ); ?></strong></label></p>
    7878                <?php submit_button( __( 'Delete My Site Permanently' ) ); ?>

  • wp-admin/my-sites.php 

    diff --git wp-admin/my-sites.php wp-admin/my-sites.php
index 2ef4ca7..6738c00 100644
    else : 
    111111        }?>
    112112        </table>
    113113        <input type="hidden" name="action" value="updateblogsettings" />
    114         <?php wp_nonce_field( 'update-my-sites' ); ?>
     114        <?php wp_nonce_field( array( 'action' => 'update-my-sites' ) ); ?>
    115115        <?php submit_button(); ?>
    116116        </form>
    117117<?php endif; ?>

  • wp-admin/nav-menus.php 

    diff --git wp-admin/nav-menus.php wp-admin/nav-menus.php
index 8e00908..0e191b0 100644
    require_once( './admin-header.php' ); 
    655655                <form id="nav-menu-meta" action="" class="nav-menu-meta" method="post" enctype="multipart/form-data">
    656656                        <input type="hidden" name="menu" id="nav-menu-meta-object-id" value="<?php echo esc_attr( $nav_menu_selected_id ); ?>" />
    657657                        <input type="hidden" name="action" value="add-menu-item" />
    658                         <?php wp_nonce_field( 'add-menu_item', 'menu-settings-column-nonce' ); ?>
     658                        <?php wp_nonce_field( array( 'action' => 'add-menu_item',
     659                                                                                 'name' => 'menu-settings-column-nonce' ) ); ?>
    659660                        <?php do_accordion_sections( 'nav-menus', 'side', null ); ?>
    660661                </form>
    661662
    … … require_once( './admin-header.php' ); 
    665666                        <form id="update-nav-menu" action="" method="post" enctype="multipart/form-data">
    666667                                <div class="menu-edit <?php if ( $add_new_screen ) echo 'blank-slate'; ?>">
    667668                                        <?php
    668                                         wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false );
    669                                         wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false );
    670                                         wp_nonce_field( 'update-nav_menu', 'update-nav-menu-nonce' );
     669                                        wp_nonce_field( array( 'action' => 'closedpostboxes',
     670                                                                                   'name' => 'closedpostboxesnonce',
     671                                                                                   'id' => 'closedpostboxesnonce',
     672                                                                                   'referrer' => false ) );
     673                                        wp_nonce_field( array( 'action'   => 'meta-box-order',
     674                                                                                   'name'     => 'meta-box-order-nonce',
     675                                                                                   'referrer' => false ) );
     676                                        wp_nonce_field( array( 'action' => 'update-nav_menu',
     677                                                                                   'name' => 'update-nav-menu-nonce' ) );
    671678
    672679                                        if ( $one_theme_location_no_menus ) { ?>
    673680                                                <input type="hidden" name="zero-menu-state" value="true" />

  • wp-admin/network.php 

    diff --git wp-admin/network.php wp-admin/network.php
index 34ab517..045ab01 100644
    function network_step1( $errors = false ) { 
    172172
    173173        echo '<form method="post" action="">';
    174174
    175         wp_nonce_field( 'install-network-1' );
     175        wp_nonce_field( array( 'action' => 'install-network-1' ) );
    176176
    177177        $error_codes = array();
    178178        if ( is_wp_error( $errors ) ) {

  • wp-admin/network/settings.php 

    diff --git wp-admin/network/settings.php wp-admin/network/settings.php
index e745694..8f36434 100644
    if ( isset( $_GET['updated'] ) ) { 
    8383        <?php screen_icon('options-general'); ?>
    8484        <h2><?php echo esc_html( $title ); ?></h2>
    8585        <form method="post" action="settings.php">
    86                 <?php wp_nonce_field( 'siteoptions' ); ?>
     86                <?php wp_nonce_field( array( 'action' => 'siteoptions' ) ); ?>
    8787                <h3><?php _e( 'Operational Settings' ); ?></h3>
    8888                <table class="form-table">
    8989                        <tr valign="top">

  • wp-admin/network/site-info.php 

    diff --git wp-admin/network/site-info.php wp-admin/network/site-info.php
index 7dd6aeb..4008ad3 100644
    if ( ! empty( $messages ) ) { 
    118118                echo '<div id="message" class="updated"><p>' . $msg . '</p></div>';
    119119} ?>
    120120<form method="post" action="site-info.php?action=update-site">
    121         <?php wp_nonce_field( 'edit-site' ); ?>
     121        <?php wp_nonce_field( array( 'action' => 'edit-site' ) ); ?>
    122122        <input type="hidden" name="id" value="<?php echo esc_attr( $id ) ?>" />
    123123        <table class="form-table">
    124124                <tr class="form-field form-required">

  • wp-admin/network/site-new.php 

    diff --git wp-admin/network/site-new.php wp-admin/network/site-new.php
index 9fc5eef..cff37a4 100644
    if ( ! empty( $messages ) ) { 
    120120                echo '<div id="message" class="updated"><p>' . $msg . '</p></div>';
    121121} ?>
    122122<form method="post" action="<?php echo network_admin_url('site-new.php?action=add-site'); ?>">
    123 <?php wp_nonce_field( 'add-blog', '_wpnonce_add-blog' ) ?>
     123<?php wp_nonce_field( array( 'action' => 'add-blog',
     124                                                         'name'   => '_wpnonce_add-blog' ) ); ?>
    124125        <table class="form-table">
    125126                <tr class="form-field form-required">
    126127                        <th scope="row"><?php _e( 'Site Address' ) ?></th>

  • wp-admin/network/site-settings.php 

    diff --git wp-admin/network/site-settings.php wp-admin/network/site-settings.php
index c3aec75..64fcf77 100644
    if ( ! empty( $messages ) ) { 
    104104                echo '<div id="message" class="updated"><p>' . $msg . '</p></div>';
    105105} ?>
    106106<form method="post" action="site-settings.php?action=update-site">
    107         <?php wp_nonce_field( 'edit-site' ); ?>
     107        <?php wp_nonce_field( array( 'action' => 'edit-site' ) ); ?>
    108108        <input type="hidden" name="id" value="<?php echo esc_attr( $id ) ?>" />
    109109        <table class="form-table">
    110110                <?php

  • wp-admin/network/site-users.php 

    diff --git wp-admin/network/site-users.php wp-admin/network/site-users.php
index 0812b50..ebfc85d 100644
    endif; ?> 
    267267                        </select></td>
    268268                </tr>
    269269        </table>
    270         <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?>
     270        <?php wp_nonce_field( array( 'action' => 'add-user',
     271                                                                 'name'   => '_wpnonce_add-user' ) ); ?>
    271272        <?php submit_button( __( 'Add User' ), 'primary', 'add-user', true, array( 'id' => 'submit-add-existing-user' ) ); ?>
    272273</form>
    273274<?php endif; ?>
    … … endif; ?> 
    301302                        <td colspan="2"><?php _e( 'Username and password will be mailed to the above email address.' ) ?></td>
    302303                </tr>
    303304        </table>
    304         <?php wp_nonce_field( 'add-user', '_wpnonce_add-new-user' ) ?>
     305        <?php wp_nonce_field( array( 'action' => 'add-user',
     306                                                                 'name'   => '_wpnonce_add-new-user' ) ); ?>
    305307        <?php submit_button( __( 'Add New User' ), 'primary', 'add-user', true, array( 'id' => 'submit-add-user' ) ); ?>
    306308</form>
    307309<?php endif; ?>

  • wp-admin/network/sites.php 

    diff --git wp-admin/network/sites.php wp-admin/network/sites.php
index 93341c3..0fd9532 100644
    if ( isset( $_GET['action'] ) ) { 
    7878                                        <input type="hidden" name="action" value="<?php echo esc_attr( $_GET['action2'] ) ?>" />
    7979                                        <input type="hidden" name="id" value="<?php echo esc_attr( $id ); ?>" />
    8080                                        <input type="hidden" name="_wp_http_referer" value="<?php echo esc_attr( wp_get_referer() ); ?>" />
    81                                         <?php wp_nonce_field( $_GET['action2'], '_wpnonce', false ); ?>
     81                                        <?php wp_nonce_field( array( 'action' => $_GET['action2'], 'referrer' => false ) ); ?>
    8282                                        <p><?php echo esc_html( wp_unslash( $_GET['msg'] ) ); ?></p>
    8383                                        <?php submit_button( __('Confirm'), 'button' ); ?>
    8484                                </form>

  • wp-admin/network/themes.php 

    diff --git wp-admin/network/themes.php wp-admin/network/themes.php
index 04840ee..e4a1a9b 100644
    if ( $action ) { 
    154154                                                foreach ( (array) $themes as $theme )
    155155                                                        echo '<input type="hidden" name="checked[]" value="' . esc_attr($theme) . '" />';
    156156                                        ?>
    157                                         <?php wp_nonce_field('bulk-themes') ?>
     157                                        <?php wp_nonce_field( array( 'action' => 'bulk-themes' ) ); ?>
    158158                                        <?php submit_button( _n( 'Yes, Delete this theme', 'Yes, Delete these themes', $themes_to_delete ), 'button', 'submit', false ); ?>
    159159                                </form>
    160160                                <form method="post" action="<?php echo esc_url(wp_get_referer()); ?>" style="display:inline;">

  • wp-admin/network/user-new.php 

    diff --git wp-admin/network/user-new.php wp-admin/network/user-new.php
index 316fffe..45b5f12 100644
    if ( isset( $add_user_errors ) && is_wp_error( $add_user_errors ) ) { ?> 
    9999                        <td colspan="2"><?php _e( 'Username and password will be mailed to the above email address.' ) ?></td>
    100100                </tr>
    101101        </table>
    102         <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?>
     102        <?php wp_nonce_field( array( 'action' => 'add-user',
     103                                                                 'name'   => '_wpnonce_add-user' ) ); ?>
    103104        <?php submit_button( __('Add User'), 'primary', 'add-user' ); ?>
    104105        </form>
    105106</div>

  • wp-admin/network/users.php 

    diff --git wp-admin/network/users.php wp-admin/network/users.php
index 1318355..fe5aaca 100644
    function confirm_delete_users( $users ) { 
    2828        <form action="users.php?action=dodelete" method="post">
    2929        <input type="hidden" name="dodelete" />
    3030        <?php
    31         wp_nonce_field( 'ms-users-delete' );
     31        wp_nonce_field( array( 'action' => 'ms-users-delete' ) );
    3232        $site_admins = get_super_admins();
    3333        $admin_out = "<option value='$current_user->ID'>$current_user->user_login</option>";
    3434

  • wp-admin/options-permalink.php 

    diff --git wp-admin/options-permalink.php wp-admin/options-permalink.php
index d086fdc..5735276 100644
    if ( ! is_multisite() ) { 
    170170<h2><?php echo esc_html( $title ); ?></h2>
    171171
    172172<form name="form" action="options-permalink.php" method="post">
    173 <?php wp_nonce_field('update-permalink') ?>
     173<?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?>
    174174
    175175  <p><?php _e('By default WordPress uses web <abbr title="Universal Resource Locator">URL</abbr>s which have question marks and lots of numbers in them, however WordPress offers you the ability to create a custom URL structure for your permalinks and archives. This can improve the aesthetics, usability, and forward-compatibility of your links. A <a href="http://codex.wordpress.org/Using_Permalinks">number of tags are available</a>, and here are some examples to get you started.'); ?></p>
    176176
    … … printf( __('If you like, you may enter custom structures for your category and t 
    256256                if ( file_exists($home_path . 'web.config') ) : ?>
    257257<p><?php _e('If your <code>web.config</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so this is the url rewrite rule you should have in your <code>web.config</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all. Then insert this rule inside of the <code>/&lt;configuration&gt;/&lt;system.webServer&gt;/&lt;rewrite&gt;/&lt;rules&gt;</code> element in <code>web.config</code> file.') ?></p>
    258258<form action="options-permalink.php" method="post">
    259 <?php wp_nonce_field('update-permalink') ?>
     259        <?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?>
    260260        <p><textarea rows="9" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_textarea( $wp_rewrite->iis7_url_rewrite_rules() ); ?></textarea></p>
    261261</form>
    262262<p><?php _e('If you temporarily make your <code>web.config</code> file writable for us to generate rewrite rules automatically, do not forget to revert the permissions after rule has been saved.') ?></p>
    263263                <?php else : ?>
    264264<p><?php _e('If the root directory of your site were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so this is the url rewrite rule you should have in your <code>web.config</code> file. Create a new file, called <code>web.config</code> in the root directory of your site. Click in the field and press <kbd>CTRL + a</kbd> to select all. Then insert this code into the <code>web.config</code> file.') ?></p>
    265265<form action="options-permalink.php" method="post">
    266 <?php wp_nonce_field('update-permalink') ?>
     266        <?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?>
    267267        <p><textarea rows="18" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_textarea( $wp_rewrite->iis7_url_rewrite_rules(true) ); ?></textarea></p>
    268268</form>
    269269<p><?php _e('If you temporarily make your site&#8217;s root directory writable for us to generate the <code>web.config</code> file automatically, do not forget to revert the permissions after the file has been created.') ?></p>
    … … printf( __('If you like, you may enter custom structures for your category and t 
    273273        if ( $permalink_structure && ! $usingpi && ! $writable ) : ?>
    274274<p><?php _e('If your <code>.htaccess</code> file were <a href="http://codex.wordpress.org/Changing_File_Permissions">writable</a>, we could do this automatically, but it isn&#8217;t so these are the mod_rewrite rules you should have in your <code>.htaccess</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all.') ?></p>
    275275<form action="options-permalink.php" method="post">
    276 <?php wp_nonce_field('update-permalink') ?>
     276        <?php wp_nonce_field( array( 'action' => 'update-permalink' ) ); ?>
    277277        <p><textarea rows="6" class="large-text readonly" name="rules" id="rules" readonly="readonly"><?php echo esc_textarea( $wp_rewrite->mod_rewrite_rules() ); ?></textarea></p>
    278278</form>
    279279        <?php endif; ?>

  • wp-admin/options.php 

    diff --git wp-admin/options.php wp-admin/options.php
index 80a0719..365de63 100644
    include('./admin-header.php'); ?> 
    178178<?php screen_icon(); ?>
    179179  <h2><?php esc_html_e('All Settings'); ?></h2>
    180180  <form name="form" action="options.php" method="post" id="all-options">
    181   <?php wp_nonce_field('options-options') ?>
     181  <?php wp_nonce_field( array( 'action' => 'options-options' ) ); ?>
    182182  <input type="hidden" name="action" value="update" />
    183183  <input type='hidden' name='option_page' value='options' />
    184184  <table class="form-table">

  • wp-admin/plugin-editor.php 

    diff --git wp-admin/plugin-editor.php wp-admin/plugin-editor.php
index 2167c1a..dc962a9 100644
    foreach ( $plugin_files as $plugin_file ) : 
    223223        </ul>
    224224</div>
    225225<form name="template" id="template" action="plugin-editor.php" method="post">
    226         <?php wp_nonce_field('edit-plugin_' . $file) ?>
     226        <?php wp_nonce_field( array( 'action' => 'edit-plugin_' . $file ) ); ?>
    227227                <div><textarea cols="70" rows="25" name="newcontent" id="newcontent" aria-describedby="newcontent-description"><?php echo $content; ?></textarea>
    228228                <input type="hidden" name="action" value="update" />
    229229                <input type="hidden" name="file" value="<?php echo esc_attr($file) ?>" />

  • wp-admin/plugins.php 

    diff --git wp-admin/plugins.php wp-admin/plugins.php
index c371b64..ad35832 100644
    if ( $action ) { 
    294294                                                foreach ( (array) $plugins as $plugin )
    295295                                                        echo '<input type="hidden" name="checked[]" value="' . esc_attr($plugin) . '" />';
    296296                                        ?>
    297                                         <?php wp_nonce_field('bulk-plugins') ?>
     297                                        <?php wp_nonce_field( array( 'action' => 'bulk-plugins' ) ); ?>
    298298                                        <?php submit_button( $data_to_delete ? __( 'Yes, Delete these files and data' ) : __( 'Yes, Delete these files' ), 'button', 'submit', false ); ?>
    299299                                </form>
    300300                                <form method="post" action="<?php echo esc_url(wp_get_referer()); ?>" style="display:inline;">

  • wp-admin/press-this.php 

    diff --git wp-admin/press-this.php wp-admin/press-this.php
index b270115..8838e16 100644
    $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( 
    443443<div id="poststuff" class="metabox-holder">
    444444        <div id="side-sortables" class="press-this-sidebar">
    445445                <div class="sleeve">
    446                         <?php wp_nonce_field('press-this') ?>
     446                        <?php wp_nonce_field( array( 'action' => 'press-this' ) ); ?>
    447447                        <input type="hidden" name="post_type" id="post_type" value="text"/>
    448448                        <input type="hidden" name="autosave" id="autosave" />
    449449                        <input type="hidden" id="original_post_status" name="original_post_status" value="draft" />
    … … $admin_body_class .= ' locale-' . sanitize_html_class( strtolower( str_replace( 
    528528                                                                </label>
    529529                                                                <?php wp_dropdown_categories( array( 'taxonomy' => 'category', 'hide_empty' => 0, 'name' => 'newcategory_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => '&mdash; ' . $tax->labels->parent_item . ' &mdash;' ) ); ?>
    530530                                                                <input type="button" id="category-add-submit" data-wp-lists="add:categorychecklist:category-add" class="button category-add-submit" value="<?php echo esc_attr( $tax->labels->add_new_item ); ?>" />
    531                                                                 <?php wp_nonce_field( 'add-category', '_ajax_nonce-add-category', false ); ?>
     531                                                                <?php wp_nonce_field( array( 'action' => 'add-category',
     532                                                                                                                         'name' => '_ajax_nonce-add-category',
     533                                                                                                                         'referrer' => false ) ); ?>
    532534                                                                <span id="category-ajax-response"></span>
    533535                                                        </p>
    534536                                                </div>

  • wp-admin/theme-editor.php 

    diff --git wp-admin/theme-editor.php wp-admin/theme-editor.php
index 8f95cab..a2497c9 100644
    if ( $allowed_files ) : 
    198198        echo '<div class="error"><p>' . __('Oops, no such file exists! Double check the name and try again, merci.') . '</p></div>';
    199199else : ?>
    200200        <form name="template" id="template" action="theme-editor.php" method="post">
    201         <?php wp_nonce_field( 'edit-theme_' . $file . $stylesheet ); ?>
     201        <?php wp_nonce_field( array( 'action' => 'edit-theme_' . $file . $stylesheet ) ); ?>
    202202                <div><textarea cols="70" rows="30" name="newcontent" id="newcontent" aria-describedby="newcontent-description"><?php echo $content; ?></textarea>
    203203                <input type="hidden" name="action" value="update" />
    204204                <input type="hidden" name="file" value="<?php echo esc_attr( $relative_file ); ?>" />

  • wp-admin/update-core.php 

    diff --git wp-admin/update-core.php wp-admin/update-core.php
index c8f5877..38cbdb2 100644
    function list_core_update( $update ) { 
    6868        echo $message;
    6969        echo '</p>';
    7070        echo '<form method="post" action="' . $form_action . '" name="upgrade" class="upgrade">';
    71         wp_nonce_field('upgrade-core');
     71        wp_nonce_field( array( 'action' => 'upgrade-core' ) );
    7272        echo '<p>';
    7373        echo '<input name="version" value="'. esc_attr($update->current) .'" type="hidden"/>';
    7474        echo '<input name="locale" value="'. esc_attr($update->locale) .'" type="hidden"/>';
    … … function list_plugin_updates() { 
    189189<h3><?php _e( 'Plugins' ); ?></h3>
    190190<p><?php _e( 'The following plugins have new versions available. Check the ones you want to update and then click &#8220;Update Plugins&#8221;.' ); ?></p>
    191191<form method="post" action="<?php echo esc_url( $form_action ); ?>" name="upgrade-plugins" class="upgrade">
    192 <?php wp_nonce_field('upgrade-core'); ?>
     192<?php wp_nonce_field( array( 'action' => 'upgrade-core' ) ); ?>
    193193<p><input id="upgrade-plugins" class="button" type="submit" value="<?php esc_attr_e('Update Plugins'); ?>" name="upgrade" /></p>
    194194<table class="widefat" cellspacing="0" id="update-plugins-table">
    195195        <thead>
    … … function list_theme_updates() { 
    267267<p><?php _e( 'The following themes have new versions available. Check the ones you want to update and then click &#8220;Update Themes&#8221;.' ); ?></p>
    268268<p><?php printf( __('<strong>Please Note:</strong> Any customizations you have made to theme files will be lost. Please consider using <a href="%s">child themes</a> for modifications.'), _x('http://codex.wordpress.org/Child_Themes', 'Link used in suggestion to use child themes in GUU') ); ?></p>
    269269<form method="post" action="<?php echo esc_url( $form_action ); ?>" name="upgrade-themes" class="upgrade">
    270 <?php wp_nonce_field('upgrade-core'); ?>
     270<?php wp_nonce_field( array( 'action' => 'upgrade-core' ) ); ?>
    271271<p><input id="upgrade-themes" class="button" type="submit" value="<?php esc_attr_e('Update Themes'); ?>" name="upgrade" /></p>
    272272<table class="widefat" cellspacing="0" id="update-themes-table">
    273273        <thead>

  • wp-admin/user-edit.php 

    diff --git wp-admin/user-edit.php wp-admin/user-edit.php
index 13a2f63..6e24098 100644
    if ( ! IS_PROFILE_PAGE ) { 
    190190</h2>
    191191
    192192<form id="your-profile" action="<?php echo esc_url( self_admin_url( IS_PROFILE_PAGE ? 'profile.php' : 'user-edit.php' ) ); ?>" method="post"<?php do_action('user_edit_form_tag'); ?>>
    193 <?php wp_nonce_field('update-user_' . $user_id) ?>
     193<?php wp_nonce_field( array( 'action' => 'update-user_' . $user_id ) ); ?>
    194194<?php if ( $wp_http_referer ) : ?>
    195195        <input type="hidden" name="wp_http_referer" value="<?php echo esc_url($wp_http_referer); ?>" />
    196196<?php endif; ?>

  • wp-admin/user-new.php 

    diff --git wp-admin/user-new.php wp-admin/user-new.php
index 13a8e12..adf86d3 100644
    if ( is_multisite() ) { 
    268268?>
    269269<form action="" method="post" name="adduser" id="adduser" class="validate"<?php do_action('user_new_form_tag');?>>
    270270<input name="action" type="hidden" value="adduser" />
    271 <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?>
     271<?php wp_nonce_field( array( 'action' => 'add-user',
     272                                                         'name'   => '_wpnonce_add-user' ) ); ?>
    272273
    273274<table class="form-table">
    274275        <tr class="form-field form-required">
    … … if ( current_user_can( 'create_users') ) { 
    301302<p><?php _e('Create a brand new user and add it to this site.'); ?></p>
    302303<form action="" method="post" name="createuser" id="createuser" class="validate"<?php do_action('user_new_form_tag');?>>
    303304<input name="action" type="hidden" value="createuser" />
    304 <?php wp_nonce_field( 'create-user', '_wpnonce_create-user' ) ?>
     305<?php wp_nonce_field( array( 'action' => 'create-user',
     306                                                         'name' => '_wpnonce_create-user' ) ); ?>
    305307<?php
    306308// Load up the passed data, else set to a default.
    307309foreach ( array( 'user_login' => 'login', 'first_name' => 'firstname', 'last_name' => 'lastname',

  • wp-admin/users.php 

    diff --git wp-admin/users.php wp-admin/users.php
index e807487..da0003e 100644
    case 'delete': 
    214214        include ('admin-header.php');
    215215?>
    216216<form action="" method="post" name="updateusers" id="updateusers">
    217 <?php wp_nonce_field('delete-users') ?>
     217<?php wp_nonce_field( array( 'action' => 'delete-users' ) ); ?>
    218218<?php echo $referer; ?>
    219219
    220220<div class="wrap">
    … … case 'remove': 
    319319        include ('admin-header.php');
    320320?>
    321321<form action="" method="post" name="updateusers" id="updateusers">
    322 <?php wp_nonce_field('remove-users') ?>
     322<?php wp_nonce_field( array( 'action' => 'remove-users' ) ); ?>
    323323<?php echo $referer; ?>
    324324
    325325<div class="wrap">

  • wp-admin/widgets.php 

    diff --git wp-admin/widgets.php wp-admin/widgets.php
index 3e0b146..ecc1d37 100644
    if ( isset($_GET['editwidget']) && $_GET['editwidget'] ) { 
    281281        <input type="hidden" name="widget-id" class="widget-id" value="<?php echo esc_attr($widget_id); ?>" />
    282282        <input type="hidden" name="id_base" class="id_base" value="<?php echo esc_attr($id_base); ?>" />
    283283        <input type="hidden" name="multi_number" class="multi_number" value="<?php echo esc_attr($multi_number); ?>" />
    284 <?php   wp_nonce_field("save-delete-widget-$widget_id"); ?>
     284        <?php wp_nonce_field( array( 'action' => "save-delete-widget-$widget_id" ) ); ?>
    285285        <br class="clear" />
    286286        </div>
    287287        </form>
    … … foreach ( $wp_registered_sidebars as $sidebar => $registered_sidebar ) { 
    389389</div>
    390390</div>
    391391<form action="" method="post">
    392 <?php wp_nonce_field( 'save-sidebar-widgets', '_wpnonce_widgets', false ); ?>
     392<?php wp_nonce_field( array( 'action' => 'save-sidebar-widgets',
     393                                                         'name' => '_wpnonce_widgets',
     394                                                         'referrer' => false ) ); ?>
    393395</form>
    394396<br class="clear" />
    395397</div>

  • wp-includes/class-wp-editor.php 

    diff --git wp-includes/class-wp-editor.php wp-includes/class-wp-editor.php
index 71236ba..f68c992 100644
    final class _WP_Editors { 
    818818        ?>
    819819        <div style="display:none;">
    820820        <form id="wp-link" tabindex="-1">
    821         <?php wp_nonce_field( 'internal-linking', '_ajax_linking_nonce', false ); ?>
     821        <?php wp_nonce_field( array( 'action' => 'internal-linking',
     822                                                                 'name' => '_ajax_linking_nonce',
     823                                                                 'id' => '_ajax_linking_nonce',
     824                                                                 'referrer' => false ) ); ?>
    822825        <div id="link-selector">
    823826                <div id="link-options">
    824827                        <p class="howto"><?php _e( 'Enter the destination URL' ); ?></p>

  • wp-includes/comment-template.php 

    diff --git wp-includes/comment-template.php wp-includes/comment-template.php
index 3d32132..362ce5e 100644
    function wp_comment_form_unfiltered_html_nonce() { 
    814814        $post_id = $post ? $post->ID : 0;
    815815
    816816        if ( current_user_can( 'unfiltered_html' ) ) {
    817                 wp_nonce_field( 'unfiltered-html-comment_' . $post_id, '_wp_unfiltered_html_comment_disabled', false );
     817                wp_nonce_field( array( 'action' => 'unfiltered-html-comment_' . $post_id,
     818                                                           'name' => '_wp_unfiltered_html_comment_disabled',
     819                                                           'id' => '_wp_unfiltered_html_comment_disabled',
     820                                                           'referrer' => false ) );
    818821                echo "<script>(function(){if(window===window.parent){document.getElementById('_wp_unfiltered_html_comment_disabled').name='_wp_unfiltered_html_comment';}})();</script>\n";
    819822        }
    820823}

  • wp-includes/functions.php 

    diff --git wp-includes/functions.php wp-includes/functions.php
index d31e58a..5012c33 100644
    function wp_nonce_url( $actionurl, $action = -1, $name = '_wpnonce' ) { 
    11861186 * offer absolute protection, but should protect against most cases. It is very
    11871187 * important to use nonce field in forms.
    11881188 *
    1189  * The $action and $name are optional, but if you want to have better security,
    1190  * it is strongly suggested to set those two parameters. It is easier to just
     1189 * The following optional settings can be used with this method:
     1190 *
     1191 * action - A unique name included in the nonce hash (for better security).
     1192 * name - The input field name, defaults to "_wpnonce".
     1193 * id - Used as the input element id if desired.
     1194 * referrer - Referrer field is used for validation, defaults to true.
     1195 * echo - Output is displayed, defaults to true. Returns the output if false.
     1196 *
     1197 * While action is optional, it is strongly recommended to set this option to a
     1198 * unique value for every form for better security. It is easier to just
    11911199 * call the function without any parameters, because validation of the nonce
    1192  * doesn't require any parameters, but since crackers know what the default is
     1200 * doesn't require any parameters, but since crackers know what the default is,
    11931201 * it won't be difficult for them to find a way around your nonce and cause
    11941202 * damage.
    11951203 *
    1196  * The input name will be whatever $name value you gave. The input value will be
    1197  * the nonce creation value.
    1198  *
    11991204 * @package WordPress
    12001205 * @subpackage Security
    12011206 * @since 2.0.4
    12021207 *
    1203  * @param string $action Optional. Action name.
    1204  * @param string $name Optional. Nonce name.
    1205  * @param bool $referer Optional, default true. Whether to set the referer field for validation.
    1206  * @param bool $echo Optional, default true. Whether to display or return hidden form field.
    1207  * @return string Nonce field.
     1208 * @param array $options Optional settings for the nonce field, see description.
     1209 *
     1210 * @return string HTML nonce field to be used in a form.
    12081211 */
    1209 function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) {
    1210         $name = esc_attr( $name );
    1211         $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';
     1212function wp_nonce_field( $options = array() ) {
     1213        $defaults = array(
     1214                'action'   => -1,
     1215                'name'     => '_wpnonce',
     1216                'id'       => '',
     1217                'referrer' => true,
     1218                'echo'     => true
     1219        );
    12121220
    1213         if ( $referer )
     1221        // WordPress 3.5 compatibility layer:
     1222        // Arguments: $action = -1, $name = "_wpnonce", $referer = true, $echo = true
     1223        // The $name parameter was also used for id.
     1224        if ( ! is_array( $options ) || 0 == func_num_args() ) {
     1225                _deprecated_argument( __FUNCTION__, '3.6', 'Please see the documentation on how to pass the necessary options to this function.' );
     1226                $old_args = func_get_args();
     1227                $options = array( 'name' => '_wpnonce' );
     1228                if ( isset( $old_args[0] ) ) $options['action']   = $old_args[0];
     1229                if ( isset( $old_args[1] ) ) $options['name']     = $old_args[1];
     1230                if ( isset( $old_args[2] ) ) $options['referrer'] = $old_args[2];
     1231                if ( isset( $old_args[3] ) ) $options['echo']     = $old_args[3];
     1232                $options['id'] = $options['name'];
     1233        }
     1234
     1235        $options = wp_parse_args( $options, $defaults );
     1236
     1237        $nonce_field = '<input type="hidden"';
     1238        if ( ! empty( $options['id'] ) ) {
     1239                $nonce_field .= ' id="' . esc_attr( $options['id'] ) . '"';
     1240        }
     1241        $nonce_field .= ' name="' . esc_attr( $options['name'] ) . '"';
     1242        $nonce_field .= ' value="' . esc_attr( wp_create_nonce( $options['action'] ) ) . '" />';
     1243
     1244        if ( $options['referrer'] )
    12141245                $nonce_field .= wp_referer_field( false );
    12151246
    1216         if ( $echo )
     1247        if ( $options['echo'] )
    12171248                echo $nonce_field;
    12181249
    12191250        return $nonce_field;

  • wp-includes/ms-functions.php 

    diff --git wp-includes/ms-functions.php wp-includes/ms-functions.php
index 1037a9f..ff5780f 100644
    function upload_is_file_too_big( $upload ) { 
    15801580function signup_nonce_fields() {
    15811581        $id = mt_rand();
    15821582        echo "<input type='hidden' name='signup_form_id' value='{$id}' />";
    1583         wp_nonce_field('signup_form_' . $id, '_signup_form', false);
     1583        wp_nonce_field( array( 'action' => 'signup_form_' . $id,
     1584                                                   'name'=> '_signup_form',
     1585                                                   'referrer' => false ) );
    15841586}
    15851587
    15861588/**