diff --git a/wp-includes/functions.php b/wp-includes/functions.php index 6c69627f65..92fb422d72 100644 --- a/wp-includes/functions.php +++ b/wp-includes/functions.php @@ -1954,11 +1954,6 @@ function wp_nonce_url( $actionurl, $action = -1 ) { * offer absolute protection, but should protect against most cases. It is very * important to use nonce field in forms. * - * If you set $echo to true and set $referer to true, then you will need to - * retrieve the {@link wp_referer_field() wp referer field}. If you have the - * $referer set to true and are echoing the nonce field, it will also echo the - * referer field. - * * The $action and $name are optional, but if you want to have better security, * it is strongly suggested to set those two parameters. It is easier to just * call the function without any parameters, because validation of the nonce @@ -1982,11 +1977,12 @@ function wp_nonce_url( $actionurl, $action = -1 ) { function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) { $name = esc_attr( $name ); $nonce_field = ''; - if ( $echo ) - echo $nonce_field; if ( $referer ) - wp_referer_field( $echo ); + $nonce_field .= wp_referer_field( false ); + + if ( $echo ) + echo $nonce_field; return $nonce_field; }