WordPress.org
Get WordPress

Make WordPress Core

Opened 13 years ago

Closed 13 years ago

#15969 closed defect (bug) (fixed)

Audit nonces

Reported by: ryan's profile ryan Owned by:
Milestone: 3.1 Priority: normal
Severity: normal Version:
Component: Security Keywords: close
Focuses: Cc:

Description

Audit for nonces, especially in network admin.

Attachments (3)

delete.diff​ (952 bytes) - added by PeteMall 13 years ago.
15969.diff​ (1.1 KB) - added by PeteMall 13 years ago.
Nonce checks for site-themes.
15969.2.diff​ (1.8 KB) - added by PeteMall 13 years ago.
Nonce checks for site-users.

Download all attachments as: .zip

Change History (15)

#1 @ryan
13 years ago

(In [17122]) nonce checks for ms themes. see #15969

@PeteMall
13 years ago

#2 @nacin
13 years ago

(In [17126]) bulk-themes nonce for network/themes.php deletion. props PeteMall, see #15969.

#3 @nacin
13 years ago

The nonce added in r17126 duplicates another check in that branch after the confirmation screen. Not sure which should go.

#4 @nacin
13 years ago

(In [17127]) Remove this check in favor of the one added in [17126]. see #15969.

#5 @nacin
13 years ago

site-themes.php and site-users.php need nonce checks. I checked the rest of the network admin.

@PeteMall
13 years ago

Nonce checks for site-themes.

#6 @ryan
13 years ago

(In [17134]) nonce checks for site-themes. Props PeteMall. see #15969

@PeteMall
13 years ago

Nonce checks for site-users.

#7 @nacin
13 years ago

  • Keywords has-patch commit added

#8 @westi
13 years ago

  • Keywords dev-reviewed added

Looks good here too. Committing.

#9 @westi
13 years ago

(In [17136]) Nonce checks for site-users. See #15969 props PeteMall.

#10 @nacin
13 years ago

If someone else can do a sweep of the network admin (I already have), that'd be great.

Please also sweep network-specific pieces in plugins.php and related pages.

#11 @PeteMall
13 years ago

  • Keywords close added; has-patch commit dev-reviewed removed

Nonces in the network admin look good to me.

#12 @nacin
13 years ago

  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.