Changeset 20187 for trunk/wp-includes/media.php

Timestamp:

03/15/2012 12:50:18 PM (13 years ago)

Author:

nacin

Message:

Ensure no nonce or multipart_params get passed to the plupload_default_settings filter. see #19910.

File:

• trunk/wp-includes/media.php (modified) (2 diffs)

trunk/wp-includes/media.php

@@ -1453 +1453 @@
     $max_upload_size = wp_max_upload_size();
 
-    $params = array(
-        'action' => 'upload-attachment',
-    );
-    $params = apply_filters( 'plupload_default_params', $params );
-
-    $params['_wpnonce'] = wp_create_nonce( 'media-form' );
-
     $settings = array(
         'runtimes'            => 'html5,silverlight,flash,html4',
@@ -1471 +1464 @@
         'multipart'           => true,
         'urlstream_upload'    => true,
-        'multipart_params'    => $params,
     );
 
     $settings = apply_filters( 'plupload_default_settings', $settings );
+
+    $params = array(
+        'action' => 'upload-attachment',
+    );
+
+    $params = apply_filters( 'plupload_default_params', $params );
+    $params['_wpnonce'] = wp_create_nonce( 'media-form' );
+    $settings['multipart_params'] = $params;
 
     $script = 'var wpPluploadDefaults = ' . json_encode( $settings ) . ';';