Changeset 22932

Timestamp:

11/30/2012 12:02:03 AM (13 years ago)

Author:

nacin

Message:

Nonces for dashboard controls.

File:

• branches/3.4/wp-admin/includes/dashboard.php (modified) (2 diffs, 1 prop)

branches/3.4/wp-admin/includes/dashboard.php

@@ -132 +132 @@
 
     if ( 'POST' == $_SERVER['REQUEST_METHOD'] && isset($_POST['widget_id']) ) {
+        check_admin_referer( 'edit-dashboard-widget_' . $_POST['widget_id'] );
         ob_start(); // hack - but the same hack wp-admin/widgets.php uses
         wp_dashboard_trigger_widget_control( $_POST['widget_id'] );
@@ -183 +184 @@
     echo '<form action="" method="post" class="dashboard-widget-control-form">';
     wp_dashboard_trigger_widget_control( $meta_box['id'] );
+    wp_nonce_field( 'edit-dashboard-widget_' . $meta_box['id'] );
     echo '<input type="hidden" name="widget_id" value="' . esc_attr($meta_box['id']) . '" />';
     submit_button( __('Submit') );