Changeset 17568 for trunk/wp-admin/includes/media.php

Timestamp:

03/28/2011 09:30:59 PM (13 years ago)

Author:

ryan

Message:

Add some nonce checks to the uploaders. Props duck_. For trunk.

File:

• trunk/wp-admin/includes/media.php (modified) (4 diffs)

trunk/wp-admin/includes/media.php

@@ -500 +500 @@
 
     if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+        check_admin_referer('media-form');
         // Upload File button was clicked
         $id = media_handle_upload('async-upload', $_REQUEST['post_id']);
@@ -605 +606 @@
 
     if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+        check_admin_referer('media-form');
         // Upload File button was clicked
         $id = media_handle_upload('async-upload', $_REQUEST['post_id']);
@@ -663 +665 @@
 
     if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+        check_admin_referer('media-form');
         // Upload File button was clicked
         $id = media_handle_upload('async-upload', $_REQUEST['post_id']);
@@ -721 +724 @@
 
     if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
+        check_admin_referer('media-form');
         // Upload File button was clicked
         $id = media_handle_upload('async-upload', $_REQUEST['post_id']);