Changeset 37145 for trunk/src/wp-admin/includes/ajax-actions.php

Timestamp:

03/30/2016 06:35:37 PM (8 years ago)

Author:

jorbin

Message:

Add Nonce to updating wporg_favorites user meta field

File:

• trunk/src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -2760 +2760 @@
 
     if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
-        wp_send_json_error();
+        wp_send_json_error(111);
 
     if ( ! current_user_can( 'read_post', $post->ID ) )
-        wp_send_json_error();
+        wp_send_json_error(222);
 
     // Really just pre-loading the cache here.
     if ( ! $revisions = wp_get_post_revisions( $post->ID, array( 'check_enabled' => false ) ) )
-        wp_send_json_error();
+        wp_send_json_error(333);
 
     $return = array();
@@ -3318 +3318 @@
     }
 
+    check_ajax_referer( 'save_wporg_username_' . get_current_user_id() );
+
     $username = isset( $_REQUEST['username'] ) ? wp_unslash( $_REQUEST['username'] ) : false;