WordPress.org
Get WordPress

Make WordPress Core

Ticket #2678: 2678inline.diff

File 2678inline.diff, 6.0 KB (added by mdawaffe, 20 years ago)

Better nonces for inlineuploading

  • wp-admin/inline-uploading.php

     
    22
    33require_once('admin.php');
    44
    5 check_admin_referer('inlineuploading');
    6 
    75header('Content-Type: text/html; charset=' . get_option('blog_charset'));
    86
    97if (!current_user_can('upload_files'))
    … …  
    3634
    3735case 'delete':
    3836
     37check_admin_referer('inlineuploading');
     38
    3939if ( !current_user_can('edit_post', (int) $attachment) )
    4040        die(__('You are not allowed to delete this attachment.').' <a href="'.basename(__FILE__)."?post=$post&amp;all=$all&amp;action=upload\">".__('Go back').'</a>');
    4141
    4242wp_delete_attachment($attachment);
    4343
    44 header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=$start", 'inlineuploading'));
     44header("Location: " . basename(__FILE__) ."?post=$post&all=$all&action=view&start=$start");
    4545die;
    4646
    4747case 'save':
    4848
     49check_admin_referer('inlineuploading');
     50
    4951$overrides = array('action'=>'save');
    5052
    5153$file = wp_handle_upload($_FILES['image'], $overrides);
    … …  
    100102        add_post_meta($id, '_wp_attachment_metadata', array());
    101103}
    102104
    103 header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=0", 'inlineuploading'));
     105header("Location: " . basename(__FILE__) . "?post=$post&all=$all&action=view&start=0");
    104106die();
    105107
    106108case 'upload':
    … …  
    139141$attachments = $wpdb->get_results("SELECT ID, post_date, post_title, post_mime_type, guid FROM $wpdb->posts WHERE post_type = 'attachment' $and_type $and_post $and_user ORDER BY $sort LIMIT $start, $double", ARRAY_A);
    140142
    141143if ( count($attachments) == 0 ) {
    142         header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&action=upload", 'inlineuploading') );
     144        header("Location: " . basename(__FILE__) ."?post=$post&action=upload" );
    143145        die;
    144146} elseif ( count($attachments) > $num ) {
    145147        $next = $start + count($attachments) - $num;
    … …  
    213215                </noscript>
    214216";
    215217                $send_delete_cancel = "<a onclick=\"sendToEditor({$ID});return false;\" href=\"javascript:void()\">$__send_to_editor</a>
    216 <a onclick=\"return confirm('$__confirmdelete')\" href=\"".basename(__FILE__)."?action=delete&amp;attachment={$ID}&amp;all=$all&amp;start=$start&amp;post=$post\">$__delete</a>
     218<a onclick=\"return confirm('$__confirmdelete')\" href=\"" . wp_nonce_url( basename(__FILE__) . "?action=delete&amp;attachment={$ID}&amp;all=$all&amp;start=$start&amp;post=$post", inlineuploading) . "\">$__delete</a>
    217219                <a onclick=\"popup.style.display='none';return false;\" href=\"javascript:void()\">$__close</a>
    218220";
    219221                $uwidth_sum += 128;
    … …  
    641643</head>
    642644<body>
    643645<ul id="upload-menu">
    644 <li<?php echo $current_1; ?>><a href="<?php echo basename(__FILE__); ?>?action=upload&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $start; ?>"><?php _e('Upload'); ?></a></li>
     646<li<?php echo $current_1; ?>><a href="<?php echo basename(__FILE__) . "?action=upload&amp;post=$post&amp;all=$all&amp;start=$start"; ?>"><?php _e('Upload'); ?></a></li>
    645647<?php if ( $attachments = $wpdb->get_results("SELECT ID FROM $wpdb->posts WHERE post_parent = '$post'") ) { ?>
    646 <li<?php echo $current_2; ?>><a href="<?php echo basename(__FILE__); ?>?action=view&amp;post=<?php echo $post; ?>&amp;all=false"><?php _e('Browse'); ?></a></li>
     648<li<?php echo $current_2; ?>><a href="<?php echo basename(__FILE__) . "?action=view&amp;post=$post&amp;all=false"; ?>"><?php _e('Browse'); ?></a></li>
    647649<?php } ?>
    648650<?php if ($wpdb->get_var("SELECT count(ID) FROM $wpdb->posts WHERE post_type = 'attachment'")) { ?>
    649 <li<?php echo $current_3; ?>><a href="<?php echo basename(__FILE__); ?>?action=view&amp;post=<?php echo $post; ?>&amp;all=true"><?php _e('Browse All'); ?></a></li>
     651<li<?php echo $current_3; ?>><a href="<?php echo basename(__FILE__) . "?action=view&amp;post=$post&amp;all=true"; ?>"><?php _e('Browse All'); ?></a></li>
    650652<?php } ?>
    651653<li> </li>
    652654<?php if ( $action == 'view' ) { ?>
    653655<?php if ( false !== $back ) : ?>
    654 <li class="spacer"><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=0" title="<?php _e('First'); ?>">|&laquo;</a></li>
    655 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $back; ?>"">&laquo; <?php _e('Back'); ?></a></li>
     656<li class="spacer"><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=0"; ?>" title="<?php _e('First'); ?>">|&laquo;</a></li>
     657<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=$back"; ?>">&laquo; <?php _e('Back'); ?></a></li>
    656658<?php else : ?>
    657659<li class="inactive spacer">|&laquo;</li>
    658660<li class="inactive">&laquo; <?php _e('Back'); ?></li>
    659661<?php endif; ?>
    660662<?php if ( false !== $next ) : ?>
    661 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $next; ?>"><?php _e('Next &raquo;'); ?></a></li>
    662 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;last=true" title="<?php _e('Last'); ?>">&raquo;|</a></li>
     663<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=$next"; ?>"><?php _e('Next &raquo;'); ?></a></li>
     664<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;last=true"; ?>" title="<?php _e('Last'); ?>">&raquo;|</a></li>
    663665<?php else : ?>
    664666<li class="inactive"><?php _e('Next &raquo;'); ?></li>
    665667<li class="inactive">&raquo;|</li>
    … …  
    697699<input type="hidden" name="post" value="<?php echo $post; ?>" />
    698700<input type="hidden" name="all" value="<?php echo $all; ?>" />
    699701<input type="hidden" name="start" value="<?php echo $start; ?>" />
     702<?php wp_nonce_field( 'inlineuploading' ); ?>
    700703<div id="submit">
    701704<input type="submit" value="<?php _e('Upload'); ?>" />
    702705<?php if ( !empty($all) ) : ?>