Make WordPress Core


Ignore:
Timestamp:
03/30/2016 06:35:37 PM (9 years ago)
Author:
jorbin
Message:

Add Nonce to updating wporg_favorites user meta field

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php

    r36964 r37145  
    171171
    172172            case 'favorites':
    173                 $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
    174                 update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
     173                $action = 'save_wporg_username_' . get_current_user_id();
     174                if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $action ) ) {
     175                    $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
     176                    update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
     177                } else {
     178                    $user = get_user_option( 'wporg_favorites' );
     179                }
    175180                if ( $user )
    176181                    $args['user'] = $user;
Note: See TracChangeset for help on using the changeset viewer.