Changeset 55764 for trunk/src/wp-includes/media.php

Timestamp:

05/16/2023 02:26:01 PM (16 months ago)

Author:

audrasjb

Message:

Media: Prevent CSRF setting attachment thumbnails.

Props martinkrcho, paulkevan, peterwilsoncc, xknown, peterwilsoncc.

File:

• trunk/src/wp-includes/media.php (modified) (1 diff)

trunk/src/wp-includes/media.php

@@ -4529 +4529 @@
         'captions'          => ! apply_filters( 'disable_captions', '' ),
         'nonce'             => array(
-            'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
+            'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
+            'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
         ),
         'post'              => array(