Changeset 49379 for branches/5.5/src/wp-admin/includes/class-custom-background.php

Timestamp:

10/29/2020 05:33:43 PM (4 years ago)

Author:

whyisjake

Message:

Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.

Props xknown, zieladam, peterwilsoncc, whyisjake

File:

• branches/5.5/src/wp-admin/includes/class-custom-background.php (modified) (1 diff)

branches/5.5/src/wp-admin/includes/class-custom-background.php

@@ -582 +582 @@
      */
     public function wp_set_background_image() {
+        check_ajax_referer( 'custom-background' );
+
         if ( ! current_user_can( 'edit_theme_options' ) || ! isset( $_POST['attachment_id'] ) ) {
             exit;