Changeset 42246 for trunk

Timestamp:

11/27/2017 03:43:11 AM (7 years ago)

Author:

dd32

Message:

Theme Editior: Base the nonce on a simpler combination of fields, for easier debugging & reading.

See #42609.
Fixes #42705.

Location:

trunk/src/wp-admin

Files:

• includes/file.php (modified) (2 diffs)
• theme-editor.php (modified) (2 diffs)

trunk/src/wp-admin/includes/file.php

@@ -415 +415 @@
         }
 
-        $real_file = $theme->get_stylesheet_directory() . '/' . $file;
-        if ( ! wp_verify_nonce( $args['nonce'], 'edit-theme_' . $real_file . $stylesheet ) ) {
+        if ( ! wp_verify_nonce( $args['nonce'], 'edit-theme_' . $stylesheet . '_' . $file ) ) {
             return new WP_Error( 'nonce_failure' );
         }
@@ -451 +450 @@
         }
 
+        $real_file = $theme->get_stylesheet_directory() . '/' . $file;
+
         $is_active = ( get_stylesheet() === $stylesheet || get_template() === $stylesheet );
+
     } else {
         return new WP_Error( 'missing_theme_or_plugin' );

trunk/src/wp-admin/theme-editor.php

@@ -115 +115 @@
     if ( is_wp_error( $r ) ) {
         $edit_error = $r;
-        if ( check_ajax_referer( 'edit-theme_' . $file . $stylesheet, 'nonce', false ) && isset( $_POST['newcontent'] ) ) {
+        if ( check_ajax_referer( 'edit-theme_' . $stylesheet . '_' . $relative_file, 'nonce', false ) && isset( $_POST['newcontent'] ) ) {
             $posted_content = wp_unslash( $_POST['newcontent'] );
         }
@@ -256 +256 @@
 else : ?>
     <form name="template" id="template" action="theme-editor.php" method="post">
-        <?php wp_nonce_field( 'edit-theme_' . $file . $stylesheet, 'nonce' ); ?>
+        <?php wp_nonce_field( 'edit-theme_' . $stylesheet . '_' . $relative_file, 'nonce' ); ?>
         <div>
             <label for="newcontent" id="theme-plugin-editor-label"><?php _e( 'Selected file content:' ); ?></label>