Changeset 42246

Timestamp:

11/27/2017 03:43:11 AM (9 years ago)

Author:

dd32

Message:

Theme Editior: Base the nonce on a simpler combination of fields, for easier debugging & reading.

See #42609.
Fixes #42705.

Location:

trunk/src/wp-admin

Files:

• includes/file.php (modified) (2 diffs)
• theme-editor.php (modified) (2 diffs)

trunk/src/wp-admin/includes/file.php

@@ -415 +415 @@
                 }
 
-                $real_file = $theme->get_stylesheet_directory() . '/' . $file;
-                if ( ! wp_verify_nonce( $args['nonce'], 'edit-theme_' . $real_file . $stylesheet ) ) {
+                if ( ! wp_verify_nonce( $args['nonce'], 'edit-theme_' . $stylesheet . '_' . $file ) ) {
                         return new WP_Error( 'nonce_failure' );
                 }
@@ -451 +450 @@
                 }
 
+                $real_file = $theme->get_stylesheet_directory() . '/' . $file;
+
                 $is_active = ( get_stylesheet() === $stylesheet || get_template() === $stylesheet );
+
         } else {
                 return new WP_Error( 'missing_theme_or_plugin' );

trunk/src/wp-admin/theme-editor.php

@@ -115 +115 @@
         if ( is_wp_error( $r ) ) {
                 $edit_error = $r;
-                if ( check_ajax_referer( 'edit-theme_' . $file . $stylesheet, 'nonce', false ) && isset( $_POST['newcontent'] ) ) {
+                if ( check_ajax_referer( 'edit-theme_' . $stylesheet . '_' . $relative_file, 'nonce', false ) && isset( $_POST['newcontent'] ) ) {
                         $posted_content = wp_unslash( $_POST['newcontent'] );
                 }
@@ -256 +256 @@
 else : ?>
         <form name="template" id="template" action="theme-editor.php" method="post">
-                <?php wp_nonce_field( 'edit-theme_' . $file . $stylesheet, 'nonce' ); ?>
+                <?php wp_nonce_field( 'edit-theme_' . $stylesheet . '_' . $relative_file, 'nonce' ); ?>
                 <div>
                         <label for="newcontent" id="theme-plugin-editor-label"><?php _e( 'Selected file content:' ); ?></label>