Changeset 5941

Timestamp:

08/25/2007 05:07:10 PM (17 years ago)

Author:

ryan

Message:

Add nonces to tag importers. Props xknown. fixes #4811

Location:

trunk/wp-admin/import

Files:

• utw.php (modified) (4 diffs)
• wp-cat2tag.php (modified) (4 diffs)

trunk/wp-admin/import/utw.php

@@ -32 +32 @@
             $step = (int) $_GET['step'];
         }
+        
+        if ( $step > 1 )
+            check_admin_referer('import-utw');
 
         // load the header
@@ -103 +106 @@
 
         echo '<form action="admin.php?import=utw&amp;step=2" method="post">';
+        wp_nonce_field('import-utw');
         echo '<p class="submit"><input type="submit" name="submit" value="'.__('Step 2 &raquo;').'" /></p>';
         echo '</form>';
@@ -138 +142 @@
 
         echo '<form action="admin.php?import=utw&amp;step=3" method="post">';
+        wp_nonce_field('import-utw');
         echo '<p class="submit"><input type="submit" name="submit" value="'.__('Step 3 &raquo;').'" /></p>';
         echo '</form>';
@@ -156 +161 @@
 
         echo '<form action="admin.php?import=utw&amp;step=4" method="post">';
+        wp_nonce_field('import-utw');
         echo '<p class="submit"><input type="submit" name="submit" value="'.__('Step 4 &raquo;').'" /></p>';
         echo '</form>';

trunk/wp-admin/import/wp-cat2tag.php

@@ -39 +39 @@
     function categories_form() {
         print '<form action="admin.php?import=wp-cat2tag&amp;step=2" method="post">';
+        wp_nonce_field('import-cat2tag');
         print '<ul style="list-style:none">';
 
@@ -145 +146 @@
 
         print '<form action="admin.php?import=wp-cat2tag" method="post">';
+        wp_nonce_field('import-cat2tag');
         print '<p style="text-align:center" class="submit"><input type="submit" value="' . __('Yes') . '" name="yes_convert_all_cats" />&nbsp;&nbsp;&nbsp;&nbsp;<input type="submit" value="' . __('No') . '" name="no_dont_do_it" /></p>';
         print '</form>';
@@ -159 +161 @@
 
     function init() {
-        echo '<!--'; print_r($_POST); print_r($_GET); echo '-->';
 
         if (isset($_POST['maybe_convert_all_cats'])) {
@@ -178 +179 @@
             print '</div>';
         } else {
+            if ( $step > 1 )
+                check_admin_referer('import-cat2tag');
+
             switch ($step) {
                 case 1 :