Changeset 11596

Timestamp:

06/18/2009 12:33:51 AM (17 years ago)

Author:

ryan

Message:

Require all plugin page requests (?page=) to be for registered plugins pages. Provides CYA for plugins that don't do enough cap checking. action requests not bound to a plugin page still go through.

File:

• branches/2.8/wp-admin/includes/plugin.php (modified) (8 diffs)

branches/2.8/wp-admin/includes/plugin.php

@@ -586 +586 @@
 
 function add_menu_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '' ) {
-        global $menu, $admin_page_hooks;
+        global $menu, $admin_page_hooks, $_registered_pages;
 
         $file = plugin_basename( $file );
@@ -603 +603 @@
         $menu[] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
 
+        $_registered_pages[$hookname] = true;
+
         return $hookname;
 }
 
 function add_object_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
-        global $menu, $admin_page_hooks, $_wp_last_object_menu;
+        global $menu, $admin_page_hooks, $_wp_last_object_menu, $_registered_pages;
 
         $file = plugin_basename( $file );
@@ -624 +626 @@
         $menu[$_wp_last_object_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
 
+        $_registered_pages[$hookname] = true;
+
         return $hookname;
 }
 
 function add_utility_page( $page_title, $menu_title, $access_level, $file, $function = '', $icon_url = '') {
-        global $menu, $admin_page_hooks, $_wp_last_utility_menu;
+        global $menu, $admin_page_hooks, $_wp_last_utility_menu, $_registered_pages;
 
         $file = plugin_basename( $file );
@@ -646 +650 @@
 
         $menu[$_wp_last_utility_menu] = array ( $menu_title, $access_level, $file, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
+
+        $_registered_pages[$hookname] = true;
 
         return $hookname;
@@ -655 +661 @@
         global $_wp_real_parent_file;
         global $_wp_submenu_nopriv;
+        global $_registered_pages;
 
         $file = plugin_basename( $file );
@@ -683 +690 @@
         if (!empty ( $function ) && !empty ( $hookname ))
                 add_action( $hookname, $function );
+
+        $_registered_pages[$hookname] = true;
 
         return $hookname;
@@ -920 +929 @@
         global $_wp_submenu_nopriv;
         global $plugin_page;
+        global $_registered_pages;
 
         $parent = get_admin_page_parent();
@@ -926 +936 @@
                 return false;
 
-        if ( isset( $plugin_page ) && isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
-                return false;
+        if ( isset( $plugin_page ) ) {
+                if ( isset( $_wp_submenu_nopriv[$parent][$plugin_page] ) )
+                        return false;
+
+                $hookname = get_plugin_page_hookname($plugin_page, $parent);
+                if ( !isset($_registered_pages[$hookname]) )
+                        return false;
+        }
 
         if ( empty( $parent) ) {