Changeset 17255 for trunk/wp-admin/admin-ajax.php

Timestamp:

01/11/2011 08:03:50 PM (14 years ago)

Author:

nacin

Message:

Nonce checks for internal linking and list table ajax. fixes #16188.

File:

• trunk/wp-admin/admin-ajax.php (modified) (3 diffs)

trunk/wp-admin/admin-ajax.php

@@ -53 +53 @@
 case 'fetch-list' :
 
+    $list_class = $_GET['list_args']['class'];
+    check_ajax_referer( "fetch-list-$list_class", '_ajax_fetch_list_nonce' );
+
     $current_screen = (object) $_GET['list_args']['screen'];
     //TODO fix this in a better way see #15336
@@ -61 +64 @@
     define( 'WP_USER_ADMIN', $current_screen->is_user );
 
-    $wp_list_table = get_list_table( $_GET['list_args']['class'] );
+    $wp_list_table = get_list_table( $list_class );
     if ( ! $wp_list_table )
         die( '0' );
@@ -1090 +1093 @@
     require_once ABSPATH . 'wp-admin/includes/internal-linking.php';
 
+    check_ajax_referer( 'internal-linking', '_ajax_linking_nonce' );
+
     $args = array();