WordPress.org

Make WordPress Core

Changeset 38006


Ignore:
Timestamp:
07/07/2016 05:12:54 PM (4 years ago)
Author:
jeremyfelt
Message:

Multisite: Add a nonce to the "Cancel" URL when changing a site's admin email.

Props scottbasgaard.
Fixes #36954.

Location:
trunk/src/wp-admin
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/options-general.php

    r37985 r38006  
    113113    printf(
    114114        ' <a href="%1$s">%2$s</a>',
    115         esc_url( admin_url( 'options.php?dismiss=new_admin_email' ) ),
     115        esc_url( wp_nonce_url( admin_url( 'options.php?dismiss=new_admin_email' ), 'dismiss-' . get_current_blog_id() . '-new_admin_email' ) ),
    116116        __( 'Cancel' )
    117117    );
  • trunk/src/wp-admin/options.php

    r37985 r38006  
    6767        exit;
    6868    } elseif ( ! empty( $_GET['dismiss'] ) && 'new_admin_email' == $_GET['dismiss'] ) {
     69        check_admin_referer( 'dismiss-' . get_current_blog_id() . '-new_admin_email' );
    6970        delete_option( 'adminhash' );
    7071        delete_option( 'new_admin_email' );
Note: See TracChangeset for help on using the changeset viewer.