From c2312dfe4ca518c40e6968afc40d9f10f5571882 Mon Sep 17 00:00:00 2001 From: Scott Taylor Date: Sat, 21 Sep 2013 16:26:12 +0000 Subject: [PATCH] Use `elseif` when slurping the `nonce` in `check_ajax_referer()` to avoid accidentally overwriting it. Fail wonderboymusic in [25433]. Props ocean90. Fixes #25369. See [25433]. Built from https://develop.svn.wordpress.org/trunk@25550 git-svn-id: http://core.svn.wordpress.org/trunk@25470 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/pluggable.php | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 1fa7f68aad..a5dfd53496 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -832,13 +832,11 @@ if ( !function_exists('check_ajax_referer') ) : function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) { $nonce = ''; - if ( $query_arg && isset( $_REQUEST[$query_arg] ) ) - $nonce = $_REQUEST[$query_arg]; - - if ( isset( $_REQUEST['_ajax_nonce'] ) ) + if ( $query_arg && isset( $_REQUEST[ $query_arg ] ) ) + $nonce = $_REQUEST[ $query_arg ]; + elseif ( isset( $_REQUEST['_ajax_nonce'] ) ) $nonce = $_REQUEST['_ajax_nonce']; - - if ( isset( $_REQUEST['_wpnonce'] ) ) + elseif ( isset( $_REQUEST['_wpnonce'] ) ) $nonce = $_REQUEST['_wpnonce']; $result = wp_verify_nonce( $nonce, $action );