Ticket #24063: 24063.patch

wp-includes/functions.php

@@ -1174 +1174 @@
  * @return string URL with nonce action added.
  */
 function wp_nonce_url( $actionurl, $action = -1, $name = '_wpnonce' ) {
+        if ( -1 == $action )
+                _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action as the second parameter.' ), '3.6' );
+
         $actionurl = str_replace( '&', '&', $actionurl );
         return esc_html( add_query_arg( $name, wp_create_nonce( $action ), $actionurl ) );
 }
@@ -1207 +1210 @@
  * @return string Nonce field.
  */
 function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) {
+        if ( -1 == $action )
+                _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action as the first parameter.' ), '3.6' );
+
         $name = esc_attr( $name );
         $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';
 

wp-includes/pluggable.php

@@ -829 +829 @@
  * @param string $query_arg where to look for nonce in $_REQUEST (since 2.5)
  */
 function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
+        if ( -1 == $action )
+                _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.6' );
+
         if ( $query_arg )
                 $nonce = $_REQUEST[$query_arg];
         else