Changeset 37145 for trunk/src/wp-admin/includes/plugin-install.php

Timestamp:

03/30/2016 06:35:37 PM (9 years ago)

Author:

jorbin

Message:

Add Nonce to updating wporg_favorites user meta field

File:

• trunk/src/wp-admin/includes/plugin-install.php (modified) (2 diffs)

trunk/src/wp-admin/includes/plugin-install.php

@@ -301 +301 @@
  */
 function install_plugins_favorites_form() {
-    $user = ! empty( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
+    $user   = get_user_option( 'wporg_favorites' );
+    $action = 'save_wporg_username_' . get_current_user_id();
     ?>
     <p class="install-help"><?php _e( 'If you have marked plugins as favorites on WordPress.org, you can browse them here.' ); ?></p>
@@ -310 +311 @@
             <input type="search" id="user" name="user" value="<?php echo esc_attr( $user ); ?>" />
             <input type="submit" class="button" value="<?php esc_attr_e( 'Get Favorites' ); ?>" />
+            <input type="hidden" id="wporg-username-nonce" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( $action ) ); ?>" /> 
         </p>
     </form>