Changeset 55764 for trunk/src/wp-admin/includes/ajax-actions.php

Timestamp:

05/16/2023 02:26:01 PM (2 years ago)

Author:

audrasjb

Message:

Media: Prevent CSRF setting attachment thumbnails.

Props martinkrcho, paulkevan, peterwilsoncc, xknown, peterwilsoncc.

File:

• trunk/src/wp-admin/includes/ajax-actions.php (modified) (1 diff)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -2772 +2772 @@
     }
 
+    if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+        wp_send_json_error();
+    }
+
     $post_ids = array();
     // For each URL, try to find its corresponding post ID.