Changeset 37145 for trunk/src/wp-admin/theme-install.php

Timestamp:

03/30/2016 06:35:37 PM (7 years ago)

Author:

jorbin

Message:

Add Nonce to updating wporg_favorites user meta field

File:

• trunk/src/wp-admin/theme-install.php (modified) (2 diffs)

trunk/src/wp-admin/theme-install.php

@@ -157 +157 @@
         <div class="favorites-form">
             <?php
-            $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
-            update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
+            $action = 'save_wporg_username_' . get_current_user_id();
+            if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $action ) ) {
+                $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
+                update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
+            } else {
+                $user = get_user_option( 'wporg_favorites' );
+            }
             ?>
             <p class="install-help"><?php _e( 'If you have marked themes as favorites on WordPress.org, you can browse them here.' ); ?></p>
@@ -164 +169 @@
             <p>
                 <label for="wporg-username-input"><?php _e( 'Your WordPress.org username:' ); ?></label>
+                <input type="hidden" id="wporg-username-nonce" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( $action ) ); ?>" />
                 <input type="search" id="wporg-username-input" value="<?php echo esc_attr( $user ); ?>" />
                 <input type="button" class="button button-secondary favorites-form-submit" value="<?php esc_attr_e( 'Get Favorites' ); ?>" />