golem
/
twentyGOLEM
9
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Nonce checks for internal linking and list table ajax. fixes #16188. 

git-svn-id: http://svn.automattic.com/wordpress/trunk@17255 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
nacin 2011-01-11 20:03:50 +00:00
parent 1d8f93ca24
commit 6a7411f3b0
8 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
wp-admin/admin-ajax.php
View File

@ -52,6 +52,9 @@ if ( isset( $_GET['action'] ) ) :
switch ( $action = $_GET['action'] ) :
case 'fetch-list' :
$list_class = $_GET['list_args']['class'];
check_ajax_referer( "fetch-list-$list_class", '_ajax_fetch_list_nonce' );
$current_screen = (object) $_GET['list_args']['screen'];
//TODO fix this in a better way see #15336
$current_screen->is_network = 'false' === $current_screen->is_network ? false : true;
@ -60,7 +63,7 @@ case 'fetch-list' :
define( 'WP_NETWORK_ADMIN', $current_screen->is_network );
define( 'WP_USER_ADMIN', $current_screen->is_user );
$wp_list_table = get_list_table( $_GET['list_args']['class'] );
$wp_list_table = get_list_table( $list_class );
if ( ! $wp_list_table )
die( '0' );
@ -1089,6 +1092,8 @@ case 'menu-quick-search':
case 'wp-link-ajax':
require_once ABSPATH . 'wp-admin/includes/internal-linking.php';
check_ajax_referer( 'internal-linking', '_ajax_linking_nonce' );
$args = array();
if ( isset( $_POST['search'] ) )

2
wp-admin/includes/class-wp-list-table.php
View File

@ -685,6 +685,8 @@ class WP_List_Table {
function display() {
extract( $this->_args );
wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
$this->display_tablenav( 'top' );
?>

1
wp-admin/includes/internal-linking.php
View File

@ -71,6 +71,7 @@ function wp_link_query( $args = array() ) {
function wp_link_dialog() {
?>
<form id="wp-link" tabindex="-1">
<?php wp_nonce_field( 'internal-linking', '_ajax_linking_nonce', false ); ?>
<div id="link-selector">
<div id="link-options">
<p class="howto"><?php _e( 'Enter the destination URL' ); ?></p>

3
wp-admin/js/list-table.dev.js
View File

@ -104,7 +104,8 @@ window.listTable = {
fetch_list: function(data, success_callback, error_callback) {
data = $.extend(data, {
'action': 'fetch-list',
'list_args': list_args
'list_args': list_args,
'_ajax_fetch_list_nonce': $('#_ajax_fetch_list_nonce').val()
});
$.ajax({

2
wp-admin/js/list-table.js
View File

File diff suppressed because one or more lines are too long

3
wp-includes/js/tinymce/plugins/wplink/js/wplink.dev.js
View File

@ -433,7 +433,8 @@ var wpLink;
var self = this,
query = {
action : 'wp-link-ajax',
page : this.page
page : this.page,
'_ajax_linking_nonce' : $('#_ajax_linking_nonce').val()
};
if ( this.search )

2
wp-includes/js/tinymce/plugins/wplink/js/wplink.js
View File

File diff suppressed because one or more lines are too long

2
wp-includes/script-loader.php
View File

@ -270,7 +270,7 @@ function wp_default_scripts( &$scripts ) {
'l10n_print_after' => 'try{convertEntities(adminBarL10n);}catch(e){};',
) );
$scripts->add( 'wplink', "/wp-includes/js/tinymce/plugins/wplink/js/wplink$suffix.js", array('jquery'), '20101223' );
$scripts->add( 'wplink', "/wp-includes/js/tinymce/plugins/wplink/js/wplink$suffix.js", array('jquery'), '20100111' );
$scripts->localize( 'wplink', 'wpLinkL10n', array(
'update' => __('Update'),
'save' => __('Add Link'),