Changeset 22212 for trunk/wp-admin/includes/ajax-actions.php

Timestamp:

10/12/2012 04:02:45 PM (12 years ago)

Author:

koopersmith

Message:

Add a nonce to wp_ajax_save_attachment. see #21390, #21807.

File:

• trunk/wp-admin/includes/ajax-actions.php (modified) (1 diff)

trunk/wp-admin/includes/ajax-actions.php

@@ -1834 +1834 @@
         wp_send_json_error();
 
+    check_ajax_referer( 'save-attachment', 'nonce' );
+
     if ( ! current_user_can( 'edit_post', $id ) )
         wp_send_json_error();