Add some nonce checks to the uploaders. Props duck_. For trunk.
git-svn-id: http://svn.automattic.com/wordpress/trunk@17568 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
ef063f8508
commit
924f783fda
|
@ -499,6 +499,7 @@ function media_upload_image() {
|
||||||
$id = 0;
|
$id = 0;
|
||||||
|
|
||||||
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
||||||
|
check_admin_referer('media-form');
|
||||||
// Upload File button was clicked
|
// Upload File button was clicked
|
||||||
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
||||||
unset($_FILES);
|
unset($_FILES);
|
||||||
|
@ -604,6 +605,7 @@ function media_upload_audio() {
|
||||||
$id = 0;
|
$id = 0;
|
||||||
|
|
||||||
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
||||||
|
check_admin_referer('media-form');
|
||||||
// Upload File button was clicked
|
// Upload File button was clicked
|
||||||
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
||||||
unset($_FILES);
|
unset($_FILES);
|
||||||
|
@ -662,6 +664,7 @@ function media_upload_video() {
|
||||||
$id = 0;
|
$id = 0;
|
||||||
|
|
||||||
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
||||||
|
check_admin_referer('media-form');
|
||||||
// Upload File button was clicked
|
// Upload File button was clicked
|
||||||
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
||||||
unset($_FILES);
|
unset($_FILES);
|
||||||
|
@ -720,6 +723,7 @@ function media_upload_file() {
|
||||||
$id = 0;
|
$id = 0;
|
||||||
|
|
||||||
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
||||||
|
check_admin_referer('media-form');
|
||||||
// Upload File button was clicked
|
// Upload File button was clicked
|
||||||
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
||||||
unset($_FILES);
|
unset($_FILES);
|
||||||
|
|
|
@ -38,6 +38,7 @@ if ( isset($_GET['inline']) ) {
|
||||||
$errors = array();
|
$errors = array();
|
||||||
|
|
||||||
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
if ( isset($_POST['html-upload']) && !empty($_FILES) ) {
|
||||||
|
check_admin_referer('media-form');
|
||||||
// Upload File button was clicked
|
// Upload File button was clicked
|
||||||
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
$id = media_handle_upload('async-upload', $_REQUEST['post_id']);
|
||||||
unset($_FILES);
|
unset($_FILES);
|
||||||
|
|
Loading…
Reference in New Issue