From 8236eda6c69b36a157d12eaf9e9c79fd9157ebd4 Mon Sep 17 00:00:00 2001
From: Aaron Campbell <aaron@xavisys.com>
Date: Wed, 11 Jan 2017 01:47:27 +0000
Subject: [PATCH] Add nonce for widget accessibility mode.

Props vortfu.

See #23328.

Merges [39760] to 4.3 branch.

Built from https://develop.svn.wordpress.org/branches/4.3@39765


git-svn-id: http://core.svn.wordpress.org/branches/4.3@39703 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/screen.php | 3 ++-
 wp-admin/widgets.php         | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/wp-admin/includes/screen.php b/wp-admin/includes/screen.php
index fba5dc9da0..e3f978896a 100644
--- a/wp-admin/includes/screen.php
+++ b/wp-admin/includes/screen.php
@@ -1004,7 +1004,8 @@ final class WP_Screen {
 
 		switch ( $this->base ) {
 			case 'widgets':
-				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off">' . __('Disable accessibility mode') . "</a></p>\n";
+				$nonce = wp_create_nonce( 'widgets-access' );
+				$this->_screen_settings = '<p><a id="access-on" href="widgets.php?widgets-access=on&_wpnonce=' . urlencode( $nonce ) . '">' . __('Enable accessibility mode') . '</a><a id="access-off" href="widgets.php?widgets-access=off&_wpnonce=' . urlencode( $nonce ) . '">' . __('Disable accessibility mode') . "</a></p>\n";
 				break;
 			case 'post' :
 				$expand = '<div class="editor-expand hidden"><label for="editor-expand-toggle">';
diff --git a/wp-admin/widgets.php b/wp-admin/widgets.php
index 679f1032b0..e2e27d4311 100644
--- a/wp-admin/widgets.php
+++ b/wp-admin/widgets.php
@@ -17,6 +17,8 @@ if ( ! current_user_can('edit_theme_options') )
 
 $widgets_access = get_user_setting( 'widgets_access' );
 if ( isset($_GET['widgets-access']) ) {
+	check_admin_referer( 'widgets-access' );
+
 	$widgets_access = 'on' == $_GET['widgets-access'] ? 'on' : 'off';
 	set_user_setting( 'widgets_access', $widgets_access );
 }