WordPress.org

Make WordPress Core


Ignore:
Timestamp:
05/16/2017 02:52:18 PM (4 years ago)
Author:
aaroncampbell
Message:

Add nonce for updating file system credentials.

Merges [40723] to 4.6 branch.

Location:
branches/4.6
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.6

  • branches/4.6/src/wp-admin/includes/file.php

    r38236 r40725  
    10911091    $credentials = get_option('ftp_credentials', array( 'hostname' => '', 'username' => ''));
    10921092
     1093    $submitted_form = wp_unslash( $_POST );
     1094
     1095    // Verify nonce, or unset submitted form field values on failure
     1096    if ( ! isset( $_POST['_fs_nonce'] ) || ! wp_verify_nonce( $_POST['_fs_nonce'], 'filesystem-credentials' ) ) {
     1097        unset(
     1098            $submitted_form['hostname'],
     1099            $submitted_form['username'],
     1100            $submitted_form['password'],
     1101            $submitted_form['public_key'],
     1102            $submitted_form['private_key'],
     1103            $submitted_form['connection_type']
     1104        );
     1105    }
     1106
    10931107    // If defined, set it to that, Else, If POST'd, set it to that, If not, Set it to whatever it previously was(saved details in option)
    1094     $credentials['hostname'] = defined('FTP_HOST') ? FTP_HOST : (!empty($_POST['hostname']) ? wp_unslash( $_POST['hostname'] ) : $credentials['hostname']);
    1095     $credentials['username'] = defined('FTP_USER') ? FTP_USER : (!empty($_POST['username']) ? wp_unslash( $_POST['username'] ) : $credentials['username']);
    1096     $credentials['password'] = defined('FTP_PASS') ? FTP_PASS : (!empty($_POST['password']) ? wp_unslash( $_POST['password'] ) : '');
     1108    $credentials['hostname'] = defined('FTP_HOST') ? FTP_HOST : (!empty($submitted_form['hostname']) ? $submitted_form['hostname'] : $credentials['hostname']);
     1109    $credentials['username'] = defined('FTP_USER') ? FTP_USER : (!empty($submitted_form['username']) ? $submitted_form['username'] : $credentials['username']);
     1110    $credentials['password'] = defined('FTP_PASS') ? FTP_PASS : (!empty($submitted_form['password']) ? $submitted_form['password'] : '');
    10971111
    10981112    // Check to see if we are setting the public/private keys for ssh
    1099     $credentials['public_key'] = defined('FTP_PUBKEY') ? FTP_PUBKEY : (!empty($_POST['public_key']) ? wp_unslash( $_POST['public_key'] ) : '');
    1100     $credentials['private_key'] = defined('FTP_PRIKEY') ? FTP_PRIKEY : (!empty($_POST['private_key']) ? wp_unslash( $_POST['private_key'] ) : '');
     1113    $credentials['public_key'] = defined('FTP_PUBKEY') ? FTP_PUBKEY : (!empty($submitted_form['public_key']) ? $submitted_form['public_key'] : '');
     1114    $credentials['private_key'] = defined('FTP_PRIKEY') ? FTP_PRIKEY : (!empty($submitted_form['private_key']) ? $submitted_form['private_key'] : '');
    11011115
    11021116    // Sanitize the hostname, Some people might pass in odd-data:
     
    11151129    } elseif ( ( defined( 'FTP_SSL' ) && FTP_SSL ) && 'ftpext' == $type ) { //Only the FTP Extension understands SSL
    11161130        $credentials['connection_type'] = 'ftps';
    1117     } elseif ( ! empty( $_POST['connection_type'] ) ) {
    1118         $credentials['connection_type'] = wp_unslash( $_POST['connection_type'] );
     1131    } elseif ( ! empty( $submitted_form['connection_type'] ) ) {
     1132        $credentials['connection_type'] = $submitted_form['connection_type'];
    11191133    } elseif ( ! isset( $credentials['connection_type'] ) ) { //All else fails (And it's not defaulted to something else saved), Default to FTP
    11201134        $credentials['connection_type'] = 'ftp';
     
    12551269
    12561270foreach ( (array) $extra_fields as $field ) {
    1257     if ( isset( $_POST[ $field ] ) )
    1258         echo '<input type="hidden" name="' . esc_attr( $field ) . '" value="' . esc_attr( wp_unslash( $_POST[ $field ] ) ) . '" />';
     1271    if ( isset( $submitted_form[ $field ] ) )
     1272        echo '<input type="hidden" name="' . esc_attr( $field ) . '" value="' . esc_attr( $submitted_form[ $field ] ) . '" />';
    12591273}
    12601274?>
    12611275    <p class="request-filesystem-credentials-action-buttons">
     1276        <?php wp_nonce_field( 'filesystem-credentials', '_fs_nonce', false, true ); ?>
    12621277        <button class="button cancel-button" data-js-action="close" type="button"><?php _e( 'Cancel' ); ?></button>
    12631278        <?php submit_button( __( 'Proceed' ), 'button', 'upgrade', false ); ?>
Note: See TracChangeset for help on using the changeset viewer.