Changeset 9025 for trunk/wp-includes/functions.php

Timestamp:

09/28/2008 09:05:37 PM (17 years ago)

Author:

westi

Message:

Protect log out actions against CSRF. Props markjaquith and ionfish. Fixes #7790.

File:

• trunk/wp-includes/functions.php (modified) (2 diffs)

trunk/wp-includes/functions.php

@@ -2146 +2146 @@
         $trans['switch']['theme']      = array( __( 'Your attempt to switch to this theme: "%s" has failed.' ), 'use_id' );
 
+        $trans['log']['out']           = array( sprintf( __( 'You are attempting to log out of %s' ), get_bloginfo( 'sitename' ) ), false );
+
         if ( isset( $trans[$verb][$noun] ) ) {
             if ( !empty( $trans[$verb][$noun][1] ) ) {
@@ -2179 +2181 @@
     if ( wp_get_referer() )
         $html .= "</p><p><a href='" . remove_query_arg( 'updated', clean_url( wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>";
+    elseif ( 'log-out' == $action )
+        $html .= "</p><p>" . sprintf( __( "Do you really want to <a href='%s'>log out</a>?"), wp_nonce_url( site_url('wp-login.php?action=logout', 'login'), 'log-out' ) );
+
     wp_die( $html, $title);
 }