Changeset 17136

Timestamp:

12/24/2010 10:37:51 PM (14 years ago)

Author:

westi

Message:

Nonce checks for site-users. See #15969 props PeteMall.

File:

• trunk/wp-admin/network/site-users.php (modified) (6 diffs)

trunk/wp-admin/network/site-users.php

@@ -63 +63 @@
     switch ( $action ) {
         case 'newuser':
+            check_admin_referer( 'add-user', '_wpnonce_add-new-user' );
             $user = $_POST['user'];
             if ( !is_array( $_POST['user'] ) || empty( $user['username'] ) || empty( $user['email'] ) ) {
@@ -81 +82 @@
 
         case 'adduser':
+            check_admin_referer( 'add-user', '_wpnonce_add-user' );
             if ( !empty( $_POST['newuser'] ) ) {
                 $update = 'adduser';
@@ -102 +104 @@
             if ( !current_user_can('remove_users')  )
                 die(__('You can’t remove users.'));
-                
+            check_admin_referer( 'bulk-users' );
+            
             $update = 'remove';
             if ( isset( $_REQUEST['users'] ) ) {
@@ -119 +122 @@
 
         case 'promote':
+            check_admin_referer( 'bulk-users' );
             $editable_roles = get_editable_roles();
             if ( empty( $editable_roles[$_REQUEST['new_role']] ) )
@@ -259 +263 @@
         </tr>
     </table>
+    <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?>
     <?php submit_button( __('Add User'), 'primary', 'add-user' ); ?>
 </form>
@@ -294 +299 @@
         </tr>
     </table>
-    <?php wp_nonce_field( 'add-user', '_wpnonce_add-user' ) ?>
+    <?php wp_nonce_field( 'add-user', '_wpnonce_add-new-user' ) ?>
     <?php submit_button( __('Add New User'), 'primary', 'add-user' ); ?>
 </form>