Add some noncing. Props andy.
git-svn-id: http://svn.automattic.com/wordpress/trunk@8023 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
a5336482b1
commit
5ad5715af7
|
@ -26,6 +26,8 @@ if ( ($id = intval($_REQUEST['attachment_id'])) && $_REQUEST['fetch'] ) {
|
||||||
exit;
|
exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
check_admin_referer('media-form');
|
||||||
|
|
||||||
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
||||||
if (is_wp_error($id)) {
|
if (is_wp_error($id)) {
|
||||||
echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
|
echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
|
||||||
|
|
|
@ -790,6 +790,7 @@ jQuery(function($){
|
||||||
post_params : {
|
post_params : {
|
||||||
"post_id" : "<?php echo $post_id; ?>",
|
"post_id" : "<?php echo $post_id; ?>",
|
||||||
"auth_cookie" : "<?php echo $_COOKIE[AUTH_COOKIE]; ?>",
|
"auth_cookie" : "<?php echo $_COOKIE[AUTH_COOKIE]; ?>",
|
||||||
|
"_wpnonce" : "<?php echo wp_create_nonce('media-form'); ?>",
|
||||||
"type" : "<?php echo $type; ?>",
|
"type" : "<?php echo $type; ?>",
|
||||||
"tab" : "<?php echo $tab; ?>",
|
"tab" : "<?php echo $tab; ?>",
|
||||||
"short" : "1"
|
"short" : "1"
|
||||||
|
|
Loading…
Reference in New Issue