Changeset 49379

Timestamp:

10/29/2020 05:33:43 PM (6 years ago)

Author:

whyisjake

Message:

Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.

Props xknown, zieladam, peterwilsoncc, whyisjake

Location:

branches/5.5/src

Files:

• js/_enqueues/admin/custom-background.js (modified) (2 diffs)
• js/_enqueues/deprecated/media-gallery.js (modified) (3 diffs)
• wp-admin/includes/class-custom-background.php (modified) (1 diff)

branches/5.5/src/js/_enqueues/admin/custom-background.js

@@ -127 +127 @@
                                 // Grab the selected attachment.
                                 var attachment = frame.state().get('selection').first();
+                                var nonceValue = $( '#_wpnonce' ).val() || '';
 
                                 // Run an Ajax request to set the background image.
@@ -132 +133 @@
                                         action: 'set-background-image',
                                         attachment_id: attachment.id,
+                                        _ajax_nonce: nonceValue,
                                         size: 'full'
                                 }).done( function() {

branches/5.5/src/js/_enqueues/deprecated/media-gallery.js

@@ -12 +12 @@
          */
         $( 'body' ).bind( 'click.wp-gallery', function(e) {
-                var target = $( e.target ), id, img_size;
+                var target = $( e.target ), id, img_size, nonceValue;
 
                 if ( target.hasClass( 'wp-set-header' ) ) {
@@ -22 +22 @@
                         id = target.data( 'attachment-id' );
                         img_size = $( 'input[name="attachments[' + id + '][image-size]"]:checked').val();
+                        nonceValue = $( '#_wpnonce' ).val() && '';
 
                         /**
@@ -29 +30 @@
                                 action: 'set-background-image',
                                 attachment_id: id,
+                                _ajax_nonce: nonceValue,
                                 size: img_size
                         }, function() {

branches/5.5/src/wp-admin/includes/class-custom-background.php

@@ -582 +582 @@
          */
         public function wp_set_background_image() {
+                check_ajax_referer( 'custom-background' );
+
                 if ( ! current_user_can( 'edit_theme_options' ) || ! isset( $_POST['attachment_id'] ) ) {
                         exit;