WordPress.org
Get WordPress

Make WordPress Core

Ticket #2678: nonce.5.diff

File nonce.5.diff, 14.5 KB (added by ryan, 20 years ago)

More noncification.

  • wp-includes/functions-compat.php

     
    9898    }
    9999}
    100100
     101// From php.net
     102if(!function_exists('http_build_query')) {
     103   function http_build_query( $formdata, $numeric_prefix = null, $key = null ) {
     104       $res = array();
     105       foreach ((array)$formdata as $k=>$v) {
     106           $tmp_key = urlencode(is_int($k) ? $numeric_prefix.$k : $k);
     107           if ($key) $tmp_key = $key.'['.$tmp_key.']';
     108           $res[] = ( ( is_array($v) || is_object($v) ) ? http_build_query($v, null, $tmp_key) : $tmp_key."=".urlencode($v) );
     109       }
     110       $separator = ini_get('arg_separator.output');
     111       return implode($separator, $res);
     112   }
     113}
    101114?>

  • wp-includes/functions.php

     
    16631663        return $installed;
    16641664}
    16651665
     1666function wp_nonce_url($actionurl, $action = -1) {
     1667        return add_query_arg('_wpnonce', wp_create_nonce($action), $actionurl);
     1668}
     1669
     1670function wp_nonce_field($action = -1) {
     1671        echo '<input type="hidden" name="_wpnonce" value="' . wp_create_nonce($action) . '" />';
     1672}
     1673
    16661674?>

  • wp-includes/pluggable-functions.php

     
    228228endif;
    229229
    230230if ( !function_exists('check_admin_referer') ) :
    231 function check_admin_referer() {
     231function check_admin_referer($action = -1) {
     232        global $pagenow;
    232233        $adminurl = strtolower(get_settings('siteurl')).'/wp-admin';
    233234        $referer = strtolower($_SERVER['HTTP_REFERER']);
    234         if (!strstr($referer, $adminurl))
    235                 die(__('Sorry, you need to <a href="http://codex.wordpress.org/Enable_Sending_Referrers">enable sending referrers</a> for this feature to work.'));
     235        if ( !wp_verify_nonce($_REQUEST['_wpnonce'], $action) ) {
     236                $html  = "<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'>\n<html xmlns='http://www.w3.org/1999/xhtml' lang='en' xml:lang='en'>\n\n";
     237                $html .= "<head>\n\t<title>" . __('WordPress Confirmation') . "</title>\n";
     238                $html .= "</head>\n<body>\n";
     239                if ( $_POST ) {
     240                        $q = http_build_query($_POST);
     241                        $q = explode( ini_get('arg_separator.output'), $q);
     242                        $html .= "\t<form method='post' action='$pagenow'>\n";
     243                        foreach ( (array) $q as $a ) {
     244                                $v = substr(strstr($a, '='), 1);
     245                                $k = substr($a, 0, -(strlen($v)+1));
     246                                $html .= "\t\t<input type='hidden' name='" . wp_specialchars( urldecode($k), 1 ) . "' value='" . wp_specialchars( urldecode($v), 1 ) . "' />\n";
     247                        }
     248                        $html .= "\t\t<input type='hidden' name='_wpnonce' value='" . wp_create_nonce($action) . "' />\n";
     249                        $html .= "\t\t<p>" . __('Are you sure you want to do this?') . "</p>\n\t\t<p><a href='$adminurl'>No</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t</form>\n";
     250                } else {
     251                        $html .= "\t<p>" . __('Are you sure you want to do this?') . "</p>\n\t\t<p><a href='$adminurl'>No</a> <a href='" . add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] ) . "'>" . __('Yes') . "</a></p>\n";
     252                }
     253                $html .= "</body>\n</html>";
     254
     255                die($html);
     256        }
    236257        do_action('check_admin_referer');
    237 }
    238 endif;
     258}endif;
    239259
    240260if ( !function_exists('check_ajax_referer') ) :
    241261function check_ajax_referer() {
    … …  
    460480}
    461481endif;
    462482
     483if ( !function_exists('wp_verify_nonce') ) :
     484function wp_verify_nonce($nonce, $action = -1) {
     485        $user = wp_get_current_user();
     486        $uid = $user->id;
     487
     488        $i = ceil(time() / 43200);
     489
     490        //Allow for expanding range, but only do one check if we can
     491        if( substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10) == $nonce || substr(md5(($i - 1) . DB_PASSWORD . $action . $uid), -12, 10) == $nonce )
     492                return true;
     493        return false;
     494}
     495endif;
     496
     497if ( !function_exists('wp_create_nonce') ) :
     498function wp_create_nonce($action = -1) {
     499        $user = wp_get_current_user();
     500        $uid = $user->id;
     501
     502        $i = ceil(time() / 43200);
     503       
     504        return substr(md5($i . DB_PASSWORD . $action . $uid), -12, 10);
     505}
     506endif;
     507
    463508?>

  • wp-admin/inline-uploading.php

     
    22
    33require_once('admin.php');
    44
    5 check_admin_referer();
     5check_admin_referer('inlineuploading');
    66
    77header('Content-Type: text/html; charset=' . get_option('blog_charset'));
    88
    … …  
    4141
    4242wp_delete_attachment($attachment);
    4343
    44 header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=$start");
     44header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=$start", 'inlineuploading'));
    4545die;
    4646
    4747case 'save':
    … …  
    100100        add_post_meta($id, '_wp_attachment_metadata', array());
    101101}
    102102
    103 header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=0");
     103header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=0", 'inlineuploading'));
    104104die();
    105105
    106106case 'upload':
    … …  
    139139$attachments = $wpdb->get_results("SELECT ID, post_date, post_title, post_mime_type, guid FROM $wpdb->posts WHERE post_type = 'attachment' $and_type $and_post $and_user ORDER BY $sort LIMIT $start, $double", ARRAY_A);
    140140
    141141if ( count($attachments) == 0 ) {
    142         header("Location: ".basename(__FILE__)."?post=$post&action=upload");
     142        header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&action=upload", 'inlineuploading') );
    143143        die;
    144144} elseif ( count($attachments) > $num ) {
    145145        $next = $start + count($attachments) - $num;

  • wp-admin/post.php

     
    2424switch($action) {
    2525case 'postajaxpost':
    2626case 'post':
    27         check_admin_referer();
     27        check_admin_referer('add-post');
    2828       
    2929        $post_ID = 'post' == $action ? write_post() : edit_post();
    3030
    … …  
    7878        break;
    7979
    8080case 'editattachment':
    81         check_admin_referer();
    82 
    8381        $post_id = (int) $_POST['post_ID'];
    8482
     83        check_admin_referer('update-attachment' . $post_id);
     84
    8585        // Don't let these be changed
    8686        unset($_POST['guid']);
    8787        $_POST['post_type'] = 'attachment';
    … …  
    9696                add_post_meta($post_id, '_wp_attachment_metadata', $newmeta);
    9797
    9898case 'editpost':
    99         check_admin_referer();
     99        $post_ID = (int) $_POST['post_ID'];
     100        check_admin_referer('update-post' . $post_ID);
    100101       
    101102        $post_ID = edit_post();
    102103
    … …  
    121122        break;
    122123
    123124case 'delete':
    124         check_admin_referer();
    125 
    126125        $post_id = (isset($_GET['post']))  ? intval($_GET['post']) : intval($_POST['post_ID']);
     126        check_admin_referer('delete-post' . $post_id);
    127127
    128128        $post = & get_post($post_id);
    129129

  • wp-admin/edit-link-form.php

     
    22if ( ! empty($link_id) ) {
    33        $heading = __('Edit Bookmark');
    44        $submit_text = __('Save Changes &raquo;');
    5         $form = '<form name="editlink" id="editlink" method="post" action="link.php">';
     5        $form = '<form name="editlink" id="editlink" method="post" action="link.php">';
     6        $nonce_action = 'update-bookmark' . $link_id;
    67} else {
    78        $heading = __('Create Bookmark');
    89        $submit_text = __('Add Bookmark &raquo;');
    910        $form = '<form name="addlink" id="addlink" method="post" action="link.php">';
     11        $nonce_action = 'add-bookmark';
    1012}
    1113
    1214function xfn_check($class, $value = '', $type = 'check') {
    … …  
    3133<div class="wrap">
    3234<h2><?php echo $heading ?></h2>
    3335<?php echo $form ?>
    34  
     36<?php wp_nonce_field($nonce_action); ?>
     37
    3538<div id="poststuff">
    3639<div id="moremeta">
    3740<div id="grabit" class="dbx-group">

  • wp-admin/edit-form-advanced.php

     
    2222        $form_action = 'post';
    2323        $temp_ID = -1 * time();
    2424        $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='$temp_ID' />";
     25        wp_nonce_field('add-post');
    2526} else {
    2627        $form_action = 'editpost';
    2728        $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
     29        wp_nonce_field('update-post' .  $post_ID);
    2830}
    2931
    3032$form_pingback = '<input type="hidden" name="post_pingback" value="' . get_option('default_pingback_flag') . '" id="post_pingback" />';
    … …  
    173175<?php
    174176if (current_user_can('upload_files')) {
    175177        $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
    176         $uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID";
     178        $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading');
    177179        $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
    178180        if ( false != $uploading_iframe_src )
    179181                echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';

  • wp-admin/edit.php

     
    211211
    212212        case 'control_delete':
    213213                ?>
    214                 <td><?php if ( current_user_can('delete_post',$post->ID) ) { echo "<a href='post.php?action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'post', " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td>
     214                <td><?php if ( current_user_can('delete_post',$post->ID) ) { echo "<a href='" . wp_nonce_url("post.php?action=delete&amp;post=$id", 'delete-post' . $post->ID) . "' class='delete' onclick=\"return deleteSomething( 'post', " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td>
    215215                <?php
    216216                break;
    217217

  • wp-admin/link.php

     
    2929
    3030switch ($action) {
    3131                case 'deletebookmarks' :
    32                 check_admin_referer();
     32                check_admin_referer('delete-bookmarks');
    3333
    3434                // check the current user's level first.
    3535                if (!current_user_can('manage_links'))
    … …  
    5353                break;
    5454
    5555        case 'move' :
    56                 check_admin_referer();
     56                check_admin_referer('move-bookmarks');
    5757
    5858                // check the current user's level first.
    5959                if (!current_user_can('manage_links'))
    … …  
    7272                break;
    7373
    7474        case 'add' :
    75                 check_admin_referer();
     75                check_admin_referer('add-bookmark');
    7676
    7777                add_link();
    7878
    … …  
    8080                break;
    8181
    8282        case 'save' :
    83                 check_admin_referer();
    84 
    8583                $link_id = (int) $_POST['link_id'];
     84                check_admin_referer('update-bookmark' . $link_id);
     85
    8686                edit_link($link_id);
    8787
    8888                wp_redirect($this_file);
    … …  
    9090                break;
    9191
    9292        case 'delete' :
    93                 check_admin_referer();
     93                $link_id = (int) $_GET['link_id'];
     94                check_admin_referer('delete-bookmark' . $link_id);
    9495
    9596                if (!current_user_can('manage_links'))
    9697                        die(__("Cheatin' uh ?"));
    9798
    98                 $link_id = (int) $_GET['link_id'];
    99 
    10099                wp_delete_link($link_id);
    101100
    102101                wp_redirect($this_file);

  • wp-admin/link-manager.php

     
    175175<?php
    176176
    177177                echo '<td><a href="link.php?link_id='.$link->link_id.'&amp;action=edit" class="edit">'.__('Edit').'</a></td>';
    178                 echo '<td><a href="link.php?link_id='.$link->link_id.'&amp;action=delete"'." class='delete' onclick=\"return deleteSomething( 'link', $link->link_id , '".sprintf(__("You are about to delete the &quot;%s&quot; bookmark to %s.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($link->link_name, 1), wp_specialchars($link->link_url)).'\' );" class="delete">'.__('Delete').'</a></td>';
     178                echo '<td><a href="' . wp_nonce_url('link.php?link_id='.$link->link_id.'&amp;action=delete', 'delete-bookmark' . $link->link_id ) . '"'." class='delete' onclick=\"return deleteSomething( 'link', $link->link_id , '".sprintf(__("You are about to delete the &quot;%s&quot; bookmark to %s.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($link->link_name, 1), wp_specialchars($link->link_url)).'\' );" class="delete">'.__('Delete').'</a></td>';
    179179                echo '<td align="center"><input type="checkbox" name="linkcheck[]" value="'.$link->link_id.'" /></td>';
    180180                echo "\n    </tr>\n";
    181181        }

  • wp-admin/categories.php

     
    2424
    2525case 'addcat':
    2626
    27         check_admin_referer();
     27        check_admin_referer('add-category');
    2828
    2929        if ( !current_user_can('manage_categories') )
    3030                die (__('Cheatin&#8217; uh?'));
    … …  
    3535break;
    3636
    3737case 'delete':
     38        $cat_ID = (int) $_GET['cat_ID'];
     39        check_admin_referer('delete-category' .  $cat_ID);
    3840
    39         check_admin_referer();
    40 
    4141        if ( !current_user_can('manage_categories') )
    4242                die (__('Cheatin&#8217; uh?'));
    4343
    44         $cat_ID = (int) $_GET['cat_ID'];
    4544        $cat_name = get_catname($cat_ID);
    4645
    4746        // Don't delete the default cats.
    … …  
    6766<div class="wrap">
    6867 <h2><?php _e('Edit Category') ?></h2>
    6968 <form name="editcat" action="categories.php" method="post">
     69          <?php wp_nonce_field('update-category' .  $category->cat_ID); ?>
    7070          <table class="editform" width="100%" cellspacing="2" cellpadding="5">
    7171                <tr>
    7272                  <th width="33%" scope="row" valign="top"><label for="cat_name"><?php _e('Category name:') ?></label></th>
    … …  
    9999break;
    100100
    101101case 'editedcat':
    102         check_admin_referer();
     102        $cat_ID = (int) $_POST['cat_ID'];
     103        check_admin_referer('update-category' . $cat_ID);
    103104
    104105        if ( !current_user_can('manage_categories') )
    105106                die (__('Cheatin&#8217; uh?'));
    … …  
    157158<div class="wrap">
    158159    <h2><?php _e('Add New Category') ?></h2>
    159160    <form name="addcat" id="addcat" action="categories.php" method="post">
     161        <?php wp_nonce_field('add-category'); ?>
    160162        <div class="alignleft"><?php _e('Name:') ?><br />
    161163        <input type="text" name="cat_name" id="cat_name" value="" /></p>
    162164        <p><?php _e('Category parent:') ?><br />