WordPress.org
Get WordPress

Make WordPress Core

Opened 9 years ago

Closed 9 years ago

Last modified 9 years ago

#36954 closed defect (bug) (fixed)

Cancelling an admin email address change on Multisite lacks a nonce

Reported by: johnbillion's profile johnbillion Owned by: jeremyfelt's profile jeremyfelt
Milestone: 4.6 Priority: lowest
Severity: minor Version:
Component: Administration Keywords: good-first-bug has-patch
Focuses: multisite Cc:

Description

The change of admin email address on a site in Multisite requires the link in a confirmation email to be clicked before it's activated. The "Cancel" link shown next to the "Email Address" field on the General Settings screen during that process lacks a nonce.

Attachments (2)

36954.diff​ (1003 bytes) - added by scottbasgaard 9 years ago.
36954.2.diff​ (1.1 KB) - added by jeremyfelt 9 years ago.

Download all attachments as: .zip

Change History (10)

@scottbasgaard
9 years ago

#1 @scottbasgaard
9 years ago

The change of admin email address on a site in Multisite requires the link in a confirmation email to be clicked before it's activated. The "Cancel" link shown next to the "Email Address" field on the General Settings screen during that process lacks a nonce.

Nice find @johnbillion, gave it a quick go.

#2 @jeremyfelt
9 years ago

  • Keywords has-patch added; needs-patch removed
  • Milestone changed from Awaiting Review to 4.6

#3 @scottbasgaard
9 years ago

@jeremyfelt thanks! Let me know what you think and if any changes are needed.

#4 @jeremyfelt
9 years ago

  • Owner set to jeremyfelt
  • Status changed from new to reviewing

This ticket was mentioned in ​Slack in #core-multisite by flixos90. ​View the logs.
9 years ago

@jeremyfelt
9 years ago

#6 @jeremyfelt
9 years ago

@scottbasgaard Looks good! I made a small change in 36954.2.diff​ so that the nonce is unique based on the site ID. Otherwise the same "cancel" URL would work on multiple sites.

#7 @jeremyfelt
9 years ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

In 38006:

Multisite: Add a nonce to the "Cancel" URL when changing a site's admin email.

Props scottbasgaard.
Fixes #36954.

#8 @scottbasgaard
9 years ago

@jeremyfelt doh, nice catch I should have thought of that.

Thanks for the tweaks and happy to have helped.

Great work on 4.6!

Note: See TracTickets for help on using tickets.