WordPress.org

Make WordPress Core


Ignore:
Timestamp:
03/30/2016 06:40:18 PM (3 years ago)
Author:
jorbin
Message:

Add Nonce to updating wporg_favorites user meta field

Merges [37145] to the 4.4 branch

Location:
branches/4.4
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.4

  • branches/4.4/src/wp-admin/includes/class-wp-plugin-install-list-table.php

    r35241 r37146  
    171171
    172172            case 'favorites':
    173                 $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
    174                 update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
     173                $action = 'save_wporg_username_' . get_current_user_id();
     174                if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $action ) ) {
     175                    $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
     176                    update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
     177                } else {
     178                    $user = get_user_option( 'wporg_favorites' );
     179                }
    175180                if ( $user )
    176181                    $args['user'] = $user;
Note: See TracChangeset for help on using the changeset viewer.