WordPress.org

Make WordPress Core

Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#36954 closed defect (bug) (fixed)

Cancelling an admin email address change on Multisite lacks a nonce

Reported by: johnbillion Owned by: jeremyfelt
Milestone: 4.6 Priority: lowest
Severity: minor Version:
Component: Administration Keywords: good-first-bug has-patch
Focuses: multisite Cc:
PR Number:

Description

The change of admin email address on a site in Multisite requires the link in a confirmation email to be clicked before it's activated. The "Cancel" link shown next to the "Email Address" field on the General Settings screen during that process lacks a nonce.

Attachments (2)

36954.diff (1003 bytes) - added by scottbasgaard 3 years ago.
36954.2.diff (1.1 KB) - added by jeremyfelt 3 years ago.

Download all attachments as: .zip

Change History (10)

@scottbasgaard
3 years ago

#1 @scottbasgaard
3 years ago

The change of admin email address on a site in Multisite requires the link in a confirmation email to be clicked before it's activated. The "Cancel" link shown next to the "Email Address" field on the General Settings screen during that process lacks a nonce.

Nice find @johnbillion, gave it a quick go.

#2 @jeremyfelt
3 years ago

  • Keywords has-patch added; needs-patch removed
  • Milestone changed from Awaiting Review to 4.6

#3 @scottbasgaard
3 years ago

@jeremyfelt thanks! Let me know what you think and if any changes are needed.

#4 @jeremyfelt
3 years ago

  • Owner set to jeremyfelt
  • Status changed from new to reviewing

This ticket was mentioned in Slack in #core-multisite by flixos90. View the logs.


3 years ago

@jeremyfelt
3 years ago

#6 @jeremyfelt
3 years ago

@scottbasgaard Looks good! I made a small change in 36954.2.diff so that the nonce is unique based on the site ID. Otherwise the same "cancel" URL would work on multiple sites.

#7 @jeremyfelt
3 years ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

In 38006:

Multisite: Add a nonce to the "Cancel" URL when changing a site's admin email.

Props scottbasgaard.
Fixes #36954.

#8 @scottbasgaard
3 years ago

@jeremyfelt doh, nice catch I should have thought of that.

Thanks for the tweaks and happy to have helped.

Great work on 4.6!

Note: See TracTickets for help on using tickets.