Changeset 5040 for branches/2.1/wp-includes/functions.php

Timestamp:

03/14/2007 11:12:47 PM (19 years ago)

Author:

markjaquith

Message:

nonce-protect comments by users with unfiltered_html cap to prevent xsrf/xss. fixes #3973 for 2.1

File:

• branches/2.1/wp-includes/functions.php (modified) (1 diff)

branches/2.1/wp-includes/functions.php

@@ -921 +921 @@
 }
 
-function wp_nonce_field($action = -1) {
-    echo '<input type="hidden" name="_wpnonce" value="' . wp_create_nonce($action) . '" />';
-    wp_referer_field();
+function wp_nonce_field($action = -1, $name = "_wpnonce", $referer = true) {
+    $name = attribute_escape($name);
+    echo '<input type="hidden" name="' . $name . '" value="' . wp_create_nonce($action) . '" />';
+    if ( $referer )
+        wp_referer_field();
 }