Nonce checks for internal linking and list table ajax. fixes #16188.

git-svn-id: http://svn.automattic.com/wordpress/trunk@17255 1a063a9b-81f0-0310-95a4-ce76da25c4cd

wp-admin/admin-ajax.php

@@ -52,6 +52,9 @@ if ( isset( $_GET['action'] ) ) :
 switch ( $action = $_GET['action'] ) :
 case 'fetch-list' :
 
+	$list_class = $_GET['list_args']['class'];
+	check_ajax_referer( "fetch-list-$list_class", '_ajax_fetch_list_nonce' );
+
 	$current_screen = (object) $_GET['list_args']['screen'];
 	//TODO fix this in a better way see #15336
 	$current_screen->is_network = 'false' === $current_screen->is_network ? false : true;
@@ -60,7 +63,7 @@ case 'fetch-list' :
 	define( 'WP_NETWORK_ADMIN', $current_screen->is_network );
 	define( 'WP_USER_ADMIN', $current_screen->is_user );
 
-	$wp_list_table = get_list_table( $_GET['list_args']['class'] );
+	$wp_list_table = get_list_table( $list_class );
 	if ( ! $wp_list_table )
 		die( '0' );
 
@@ -1089,6 +1092,8 @@ case 'menu-quick-search':
 case 'wp-link-ajax':
 	require_once ABSPATH . 'wp-admin/includes/internal-linking.php';
 
+	check_ajax_referer( 'internal-linking', '_ajax_linking_nonce' );
+
 	$args = array();
 
 	if ( isset( $_POST['search'] ) )

wp-admin/includes/class-wp-list-table.php

@@ -685,6 +685,8 @@ class WP_List_Table {
 	function display() {
 		extract( $this->_args );
 
+		wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
+
 		$this->display_tablenav( 'top' );
 
 ?>

wp-admin/includes/internal-linking.php

@@ -71,6 +71,7 @@ function wp_link_query( $args = array() ) {
 function wp_link_dialog() {
 ?>
 <form id="wp-link" tabindex="-1">
+<?php wp_nonce_field( 'internal-linking', '_ajax_linking_nonce', false ); ?>
 <div id="link-selector">
 	<div id="link-options">
 		<p class="howto"><?php _e( 'Enter the destination URL' ); ?></p>

wp-admin/js/list-table.dev.js

@@ -104,7 +104,8 @@ window.listTable = {
 	fetch_list: function(data, success_callback, error_callback) {
 		data = $.extend(data, {
 			'action': 'fetch-list',
-			'list_args': list_args
+			'list_args': list_args,
+			'_ajax_fetch_list_nonce': $('#_ajax_fetch_list_nonce').val()
 		});
 
 		$.ajax({

wp-includes/js/tinymce/plugins/wplink/js/wplink.dev.js

@@ -433,7 +433,8 @@ var wpLink;
 			var self = this,
 				query = {
 					action : 'wp-link-ajax',
-					page : this.page
+					page : this.page,
+					'_ajax_linking_nonce' : $('#_ajax_linking_nonce').val()
 				};
 
 			if ( this.search )

wp-includes/script-loader.php

@@ -270,7 +270,7 @@ function wp_default_scripts( &$scripts ) {
 		'l10n_print_after' => 'try{convertEntities(adminBarL10n);}catch(e){};',
 	) );
 
-	$scripts->add( 'wplink', "/wp-includes/js/tinymce/plugins/wplink/js/wplink$suffix.js", array('jquery'), '20101223' );
+	$scripts->add( 'wplink', "/wp-includes/js/tinymce/plugins/wplink/js/wplink$suffix.js", array('jquery'), '20100111' );
 	$scripts->localize( 'wplink', 'wpLinkL10n', array(
 		'update' => __('Update'),
 		'save' => __('Add Link'),