Changeset 22212

Timestamp:

10/12/2012 04:02:45 PM (12 years ago)

Author:

koopersmith

Message:

Add a nonce to wp_ajax_save_attachment. see #21390, #21807.

Location:

trunk

Files:

• wp-admin/includes/ajax-actions.php (modified) (1 diff)
• wp-includes/js/media-models.js (modified) (3 diffs)
• wp-includes/script-loader.php (modified) (1 diff)

trunk/wp-admin/includes/ajax-actions.php

@@ -1834 +1834 @@
         wp_send_json_error();
 
+    check_ajax_referer( 'save-attachment', 'nonce' );
+
     if ( ! current_user_can( 'edit_post', $id ) )
         wp_send_json_error();

trunk/wp-includes/js/media-models.js

@@ -2 +2 @@
 
 (function($){
-    var Attachment, Attachments, Query, compare;
+    var Attachment, Attachments, Query, compare, l10n;
 
     /**
@@ -20 +20 @@
 
     _.extend( media, { model: {}, view: {}, controller: {} });
+
+    // Link any localized strings.
+    l10n = media.model.l10n = _.isUndefined( _wpMediaModelsL10n ) ? {} : _wpMediaModelsL10n;
 
     /**
@@ -193 +196 @@
                 options.data = _.extend( options.data || {}, {
                     action: 'save-attachment',
-                    id: this.id
+                    id:     this.id,
+                    nonce:  l10n.saveAttachmentNonce
                 });
 

trunk/wp-includes/script-loader.php

@@ -316 +316 @@
 
     $scripts->add( 'media-models', "/wp-includes/js/media-models$suffix.js", array( 'backbone', 'jquery' ), false, 1 );
+    did_action( 'init' ) && $scripts->localize( 'media-models', '_wpMediaModelsL10n', array(
+        'saveAttachmentNonce' => wp_create_nonce( 'save-attachment' ),
+    ) );
+
     $scripts->add( 'media-views',  "/wp-includes/js/media-views$suffix.js",  array( 'media-models', 'wp-plupload' ), false, 1 );
     did_action( 'init' ) && $scripts->localize( 'media-views', '_wpMediaViewsL10n', array(