Changeset 37146 for branches/4.4/src/wp-admin/includes/class-wp-plugin-install-list-table.php

Timestamp:

03/30/2016 06:40:18 PM (8 years ago)

Author:

jorbin

Message:

Add Nonce to updating wporg_favorites user meta field

Merges [37145] to the 4.4 branch

Location:

branches/4.4

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/class-wp-plugin-install-list-table.php (modified) (1 diff)

branches/4.4/src/wp-admin/includes/class-wp-plugin-install-list-table.php

@@ -171 +171 @@
 
             case 'favorites':
-                $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
-                update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
+                $action = 'save_wporg_username_' . get_current_user_id();
+                if ( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), $action ) ) {
+                    $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
+                    update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
+                } else {
+                    $user = get_user_option( 'wporg_favorites' );
+                }
                 if ( $user )
                     $args['user'] = $user;