WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Nonce checks for internal linking and list table ajax. fixes #16188. 

git-svn-id: http://svn.automattic.com/wordpress/trunk@17255 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
nacin 2011-01-11 20:03:50 +00:00
parent 1d8f93ca24
commit 6a7411f3b0
8 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
wp-admin/admin-ajax.php
View File

@ -52,6 +52,9 @@ if ( isset( $_GET['action'] ) ) :
switch ( $action = $_GET['action'] ) : switch ( $action = $_GET['action'] ) :
case 'fetch-list' : case 'fetch-list' :
$list_class = $_GET['list_args']['class'];
check_ajax_referer( "fetch-list-$list_class", '_ajax_fetch_list_nonce' );
$current_screen = (object) $_GET['list_args']['screen']; $current_screen = (object) $_GET['list_args']['screen'];
//TODO fix this in a better way see #15336 //TODO fix this in a better way see #15336
$current_screen->is_network = 'false' === $current_screen->is_network ? false : true; $current_screen->is_network = 'false' === $current_screen->is_network ? false : true;
@ -60,7 +63,7 @@ case 'fetch-list' :
define( 'WP_NETWORK_ADMIN', $current_screen->is_network ); define( 'WP_NETWORK_ADMIN', $current_screen->is_network );
define( 'WP_USER_ADMIN', $current_screen->is_user ); define( 'WP_USER_ADMIN', $current_screen->is_user );
$wp_list_table = get_list_table( $_GET['list_args']['class'] ); $wp_list_table = get_list_table( $list_class );
if ( ! $wp_list_table ) if ( ! $wp_list_table )
die( '0' ); die( '0' );
@ -1089,6 +1092,8 @@ case 'menu-quick-search':
case 'wp-link-ajax': case 'wp-link-ajax':
require_once ABSPATH . 'wp-admin/includes/internal-linking.php'; require_once ABSPATH . 'wp-admin/includes/internal-linking.php';
check_ajax_referer( 'internal-linking', '_ajax_linking_nonce' );
$args = array(); $args = array();
if ( isset( $_POST['search'] ) ) if ( isset( $_POST['search'] ) )

2
wp-admin/includes/class-wp-list-table.php
View File

@ -685,6 +685,8 @@ class WP_List_Table {
function display() { function display() {
extract( $this->_args ); extract( $this->_args );
wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
$this->display_tablenav( 'top' ); $this->display_tablenav( 'top' );
?> ?>

1
wp-admin/includes/internal-linking.php
View File

@ -71,6 +71,7 @@ function wp_link_query( $args = array() ) {
function wp_link_dialog() { function wp_link_dialog() {
?> ?>
<form id="wp-link" tabindex="-1"> <form id="wp-link" tabindex="-1">
<?php wp_nonce_field( 'internal-linking', '_ajax_linking_nonce', false ); ?>
<div id="link-selector"> <div id="link-selector">
<div id="link-options"> <div id="link-options">
<p class="howto"><?php _e( 'Enter the destination URL' ); ?></p> <p class="howto"><?php _e( 'Enter the destination URL' ); ?></p>

3
wp-admin/js/list-table.dev.js
View File

@ -104,7 +104,8 @@ window.listTable = {
fetch_list: function(data, success_callback, error_callback) { fetch_list: function(data, success_callback, error_callback) {
data = $.extend(data, { data = $.extend(data, {
'action': 'fetch-list', 'action': 'fetch-list',
'list_args': list_args 'list_args': list_args,
'_ajax_fetch_list_nonce': $('#_ajax_fetch_list_nonce').val()
}); });
$.ajax({ $.ajax({

2
wp-admin/js/list-table.js
View File

File diff suppressed because one or more lines are too long

3
wp-includes/js/tinymce/plugins/wplink/js/wplink.dev.js
View File

@ -433,7 +433,8 @@ var wpLink;
var self = this, var self = this,
query = { query = {
action : 'wp-link-ajax', action : 'wp-link-ajax',
page : this.page page : this.page,
'_ajax_linking_nonce' : $('#_ajax_linking_nonce').val()
}; };
if ( this.search ) if ( this.search )

2
wp-includes/js/tinymce/plugins/wplink/js/wplink.js
View File

File diff suppressed because one or more lines are too long

2
wp-includes/script-loader.php
View File

@ -270,7 +270,7 @@ function wp_default_scripts( &$scripts ) {
'l10n_print_after' => 'try{convertEntities(adminBarL10n);}catch(e){};', 'l10n_print_after' => 'try{convertEntities(adminBarL10n);}catch(e){};',
) ); ) );
$scripts->add( 'wplink', "/wp-includes/js/tinymce/plugins/wplink/js/wplink$suffix.js", array('jquery'), '20101223' ); $scripts->add( 'wplink', "/wp-includes/js/tinymce/plugins/wplink/js/wplink$suffix.js", array('jquery'), '20100111' );
$scripts->localize( 'wplink', 'wpLinkL10n', array( $scripts->localize( 'wplink', 'wpLinkL10n', array(
'update' => __('Update'), 'update' => __('Update'),
'save' => __('Add Link'), 'save' => __('Add Link'),