Ticket #24063: ticket-24063-req-nonce-action.2.patch

src/wp-includes/functions.php

@@ -1197 +1197 @@
  * @return string Escaped URL with nonce action added.
  */
 function wp_nonce_url( $actionurl, $action = -1, $name = '_wpnonce' ) {
+        if ( -1 == $action )
+                _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action as the second parameter.' ), '3.9' );
+
         $actionurl = str_replace( '&', '&', $actionurl );
         return esc_html( add_query_arg( $name, wp_create_nonce( $action ), $actionurl ) );
 }
@@ -1230 +1233 @@
  * @return string Nonce field.
  */
 function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) {
+        if ( -1 == $action )
+                _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action as the first parameter.' ), '3.9' );
+
         $name = esc_attr( $name );
         $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';
 

src/wp-includes/pluggable.php

@@ -828 +828 @@
  * @param string $query_arg where to look for nonce in $_REQUEST (since 2.5)
  */
 function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
+        if ( -1 == $action )
+                _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.9' );
+
         $nonce = '';
 
         if ( $query_arg && isset( $_REQUEST[ $query_arg ] ) )