Changeset 11596

Timestamp:

06/18/2009 12:33:51 AM (15 years ago)

Author:

ryan

Message:

Require all plugin page requests (?page=) to be for registered plugins pages. Provides CYA for plugins that don't do enough cap checking. action requests not bound to a plugin page still go through.

File:

• branches/2.8/wp-admin/includes/plugin.php (modified) (8 diffs)

branches/2.8/wp-admin/includes/plugin.php

@@ -586 +586 @@
 
 function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) {
-    global $menu, $admin_page_hooks;
+    global $menu, $admin_page_hooks, $_registered_pages;
 
     $file = plugin_basename( $file );
@@ -603 +603 @@
     $menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
 
+    $_registered_pages[$hookname] = true;
+
     return $hookname;
 }
 
 function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
-    global $menu, $admin_page_hooks, $_wp_last_object_menu;
+    global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages;
 
     $file = plugin_basename( $file );
@@ -624 +626 @@
     $menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
 
+    $_registered_pages[$hookname] = true;
+
     return $hookname;
 }
 
 function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
-    global $menu, $admin_page_hooks, $_wp_last_utility_menu;
+    global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages;
 
     $file = plugin_basename( $file );
@@ -646 +650 @@
 
     $menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+
+    $_registered_pages[$hookname] = true;
 
     return $hookname;
@@ -655 +661 @@
     global $_wp_real_parent_file;
     global $_wp_submenu_nopriv;
+    global $_registered_pages;
 
     $file = plugin_basename( $file );
@@ -683 +690 @@
     if (!empty ( $function ) && !empty ( $hookname ))
         add_action( $hookname, $function );
+
+    $_registered_pages[$hookname] = true;
 
     return $hookname;
@@ -920 +929 @@
     global $_wp_submenu_nopriv;
     global $plugin_page;
+    global $_registered_pages;
 
     $parent = get_admin_page_parent();
@@ -926 +936 @@
         return false;
 
-    if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
-        return false;
+    if ( isset( $plugin_page ) ) {
+        if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
+            return false;
+
+        $hookname = get_plugin_page_hookname($plugin_page, $parent);
+        if ( !isset($_registered_pages[$hookname]) )
+            return false;
+    }
 
     if ( empty( $parent) ) {