Changeset 5040 for branches/2.1/wp-includes/comment-template.php

Timestamp:

03/14/2007 11:12:47 PM (20 years ago)

Author:

markjaquith

Message:

nonce-protect comments by users with unfiltered_html cap to prevent xsrf/xss. fixes #3973 for 2.1

File:

• branches/2.1/wp-includes/comment-template.php (modified) (1 diff)

branches/2.1/wp-includes/comment-template.php

@@ -272 +272 @@
 }
 
+function wp_comment_form_unfiltered_html_nonce() {
+        global $post;
+        if ( current_user_can('unfiltered_html') )
+                wp_nonce_field('unfiltered-html-comment_' . $post->ID, '_wp_unfiltered_html_comment', false);
+}
+
 function comments_template( $file = '/comments.php' ) {
         global $wp_query, $withcomments, $post, $wpdb, $id, $comment, $user_login, $user_ID, $user_identity;