Changeset 32516

Timestamp:

05/19/2015 08:45:36 PM (9 years ago)

Author:

wonderboymusic

Message:

In WP_Comments_List_Table::column_comment(), all of the nonced URLs can be defined in the same conditional block in which they are used. Not doing this causes ambiguity, and local vars are set that are not available to all execution paths.

See #32444.

File:

• trunk/src/wp-admin/includes/class-wp-comments-list-table.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -391 +391 @@
         $the_comment_status = wp_get_comment_status( $comment->comment_ID );
 
-        if ( $this->user_can ) {
-            $del_nonce = esc_html( '_wpnonce=' . wp_create_nonce( "delete-comment_$comment->comment_ID" ) );
-            $approve_nonce = esc_html( '_wpnonce=' . wp_create_nonce( "approve-comment_$comment->comment_ID" ) );
-
-            $url = "comment.php?c=$comment->comment_ID";
-
-            $approve_url = esc_url( $url . "&action=approvecomment&$approve_nonce" );
-            $unapprove_url = esc_url( $url . "&action=unapprovecomment&$approve_nonce" );
-            $spam_url = esc_url( $url . "&action=spamcomment&$del_nonce" );
-            $unspam_url = esc_url( $url . "&action=unspamcomment&$del_nonce" );
-            $trash_url = esc_url( $url . "&action=trashcomment&$del_nonce" );
-            $untrash_url = esc_url( $url . "&action=untrashcomment&$del_nonce" );
-            $delete_url = esc_url( $url . "&action=deletecomment&$del_nonce" );
-        }
-
         echo '<div class="comment-author">';
             $this->column_author( $comment );
@@ -442 +427 @@
 
         if ( $this->user_can ) {
+            $del_nonce = esc_html( '_wpnonce=' . wp_create_nonce( "delete-comment_$comment->comment_ID" ) );
+            $approve_nonce = esc_html( '_wpnonce=' . wp_create_nonce( "approve-comment_$comment->comment_ID" ) );
+
+            $url = "comment.php?c=$comment->comment_ID";
+
+            $approve_url = esc_url( $url . "&action=approvecomment&$approve_nonce" );
+            $unapprove_url = esc_url( $url . "&action=unapprovecomment&$approve_nonce" );
+            $spam_url = esc_url( $url . "&action=spamcomment&$del_nonce" );
+            $unspam_url = esc_url( $url . "&action=unspamcomment&$del_nonce" );
+            $trash_url = esc_url( $url . "&action=trashcomment&$del_nonce" );
+            $untrash_url = esc_url( $url . "&action=untrashcomment&$del_nonce" );
+            $delete_url = esc_url( $url . "&action=deletecomment&$del_nonce" );
+
             // Preorder it: Approve | Reply | Quick Edit | Edit | Spam | Trash.
             $actions = array(