Changeset 39760 for trunk/src

Timestamp:

01/11/2017 01:31:57 AM (8 years ago)

Author:

aaroncampbell

Message:

Add nonce for widget accessibility mode.

Props vortfu.

See #23328.

Location:

trunk/src/wp-admin

Files:

• includes/class-wp-screen.php (modified) (1 diff)
• widgets.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-screen.php

@@ -916 +916 @@
         switch ( $this->base ) {
             case 'widgets':
-                $this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off">' . __('Disable accessibility mode') . "</a></p>\n";
+                $nonce = wp_create_nonce( 'widgets-access' );
+                $this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on&_wpnonce=' . urlencode( $nonce ) . '">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off&_wpnonce=' . urlencode( $nonce ) . '">' . __('Disable accessibility mode') . "</a></p>\n";
                 break;
             case 'post' :

trunk/src/wp-admin/widgets.php

@@ -23 +23 @@
 $widgets_access = get_user_setting( 'widgets_access' );
 if ( isset($_GET['widgets-access']) ) {
+    check_admin_referer( 'widgets-access' );
+
     $widgets_access = 'on' == $_GET['widgets-access'] ? 'on' : 'off';
     set_user_setting( 'widgets_access', $widgets_access );