Make WordPress Core

Changeset 39765


Ignore:
Timestamp:
01/11/2017 01:46:15 AM (8 years ago)
Author:
aaroncampbell
Message:

Add nonce for widget accessibility mode.

Props vortfu.

See #23328.

Merges [39760] to 4.3 branch.

Location:
branches/4.3/src/wp-admin
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.3/src/wp-admin/includes/screen.php

    r32844 r39765  
    10051005        switch ( $this->base ) {
    10061006            case 'widgets':
    1007                 $this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off">' . __('Disable accessibility mode') . "</a></p>\n";
     1007                $nonce = wp_create_nonce( 'widgets-access' );
     1008                $this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on&_wpnonce=' . urlencode( $nonce ) . '">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off&_wpnonce=' . urlencode( $nonce ) . '">' . __('Disable accessibility mode') . "</a></p>\n";
    10081009                break;
    10091010            case 'post' :
  • branches/4.3/src/wp-admin/widgets.php

    r33067 r39765  
    1818$widgets_access = get_user_setting( 'widgets_access' );
    1919if ( isset($_GET['widgets-access']) ) {
     20    check_admin_referer( 'widgets-access' );
     21
    2022    $widgets_access = 'on' == $_GET['widgets-access'] ? 'on' : 'off';
    2123    set_user_setting( 'widgets_access', $widgets_access );
Note: See TracChangeset for help on using the changeset viewer.