Changeset 38006

Timestamp:

07/07/2016 05:12:54 PM (8 years ago)

Author:

jeremyfelt

Message:

Multisite: Add a nonce to the "Cancel" URL when changing a site's admin email.

Props scottbasgaard.
Fixes #36954.

Location:

trunk/src/wp-admin

Files:

• options-general.php (modified) (1 diff)
• options.php (modified) (1 diff)

trunk/src/wp-admin/options-general.php

@@ -113 +113 @@
     printf(
         ' <a href="%1$s">%2$s</a>',
-        esc_url( admin_url( 'options.php?dismiss=new_admin_email' ) ),
+        esc_url( wp_nonce_url( admin_url( 'options.php?dismiss=new_admin_email' ), 'dismiss-' . get_current_blog_id() . '-new_admin_email' ) ),
         __( 'Cancel' )
     );

trunk/src/wp-admin/options.php

@@ -67 +67 @@
         exit;
     } elseif ( ! empty( $_GET['dismiss'] ) && 'new_admin_email' == $_GET['dismiss'] ) {
+        check_admin_referer( 'dismiss-' . get_current_blog_id() . '-new_admin_email' );
         delete_option( 'adminhash' );
         delete_option( 'new_admin_email' );