Changeset 5039 for trunk/wp-includes/functions.php

Timestamp:

03/14/2007 11:10:57 PM (19 years ago)

Author:

markjaquith

Message:

nonce-protect comments by users with unfiltered_html cap to prevent xsrf/xss. fixes #3973 for trunk

File:

• trunk/wp-includes/functions.php (modified) (1 diff)

trunk/wp-includes/functions.php

@@ -1001 +1001 @@
 }
 
-function wp_nonce_field($action = -1) {
-    echo '<input type="hidden" name="_wpnonce" value="' . wp_create_nonce($action) . '" />';
-    wp_referer_field();
+function wp_nonce_field($action = -1, $name = "_wpnonce", $referer = true) {
+    $name = attribute_escape($name);
+    echo '<input type="hidden" name="' . $name . '" value="' . wp_create_nonce($action) . '" />';
+    if ( $referer )
+        wp_referer_field();
 }