Changeset 33017

Timestamp:

07/01/2015 03:36:58 AM (11 years ago)

Author:

helen

Message:

Fire the check_admin_referer action on failure as well as success.

This enables things like logging nonce failures in the admin.

props markjaquith.
fixes #32207.

File:

• trunk/src/wp-includes/pluggable.php (modified) (2 diffs)

trunk/src/wp-includes/pluggable.php

@@ -1092 +1092 @@
         $referer = strtolower(wp_get_referer());
         $result = isset($_REQUEST[$query_arg]) ? wp_verify_nonce($_REQUEST[$query_arg], $action) : false;
-        if ( !$result && !(-1 == $action && strpos($referer, $adminurl) === 0) ) {
-                wp_nonce_ays($action);
-                die();
-        }
 
         /**
@@ -1107 +1103 @@
          */
         do_action( 'check_admin_referer', $action, $result );
+
+        if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
+                wp_nonce_ays( $action );
+                die();
+        }
+
         return $result;
 }