Changeset 37146 for branches/4.4/src/wp-admin/includes/ajax-actions.php

Timestamp:

03/30/2016 06:40:18 PM (10 years ago)

Author:

jorbin

Message:

Add Nonce to updating wporg_favorites user meta field

Merges [37145] to the 4.4 branch

Location:

branches/4.4

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)

branches/4.4/src/wp-admin/includes/ajax-actions.php

@@ -2753 +2753 @@
 
         if ( ! $post = get_post( (int) $_REQUEST['post_id'] ) )
-                wp_send_json_error();
+                wp_send_json_error(111);
 
         if ( ! current_user_can( 'read_post', $post->ID ) )
-                wp_send_json_error();
+                wp_send_json_error(222);
 
         // Really just pre-loading the cache here.
         if ( ! $revisions = wp_get_post_revisions( $post->ID, array( 'check_enabled' => false ) ) )
-                wp_send_json_error();
+                wp_send_json_error(333);
 
         $return = array();
@@ -3311 +3311 @@
         }
 
+        check_ajax_referer( 'save_wporg_username_' . get_current_user_id() );
+
         $username = isset( $_REQUEST['username'] ) ? wp_unslash( $_REQUEST['username'] ) : false;