Changeset 12893

Timestamp:

01/28/2010 10:07:51 PM (17 years ago)

Author:

westi

Message:

Menu hardening for the 2.8 branch see #11922

Location:

branches/2.8/wp-admin

Files:

• includes/plugin.php (modified) (1 diff)
• menu.php (modified) (1 diff)

branches/2.8/wp-admin/includes/plugin.php

@@ -593 +593 @@
 
         $hookname = get_plugin_page_hookname( $file, '' );
-        if (!empty ( $function ) && !empty ( $hookname ))
+        if (!empty ( $function ) && !empty ( $hookname ) && current_user_can( $access_level ) )
                 add_action( $hookname, $function );
 

branches/2.8/wp-admin/menu.php

@@ -199 +199 @@
 // Run re-parent loop again.
 foreach ( $menu as $id => $data ) {
+        if ( ! current_user_can($data[1]) )
+                $_wp_menu_nopriv[$data[2]] = true;
+
         // If submenu is empty...
         if ( empty($submenu[$data[2]]) ) {
                 // And user doesn't have privs, remove menu.
-                if ( ! current_user_can($data[1]) ) {
-                        $_wp_menu_nopriv[$data[2]] = true;
+                if ( isset( $_wp_menu_nopriv[$data[2]] ) ) {
                         unset($menu[$id]);
                 }