From b9487742e01f3cb8c0d94e09287043ec64d4878d Mon Sep 17 00:00:00 2001 From: markjaquith Date: Thu, 3 Feb 2011 20:42:00 +0000 Subject: [PATCH] Improvement to check_admin_referer() when called without first argument (PLUGIN AUTHORS: STOP DOING THAT). props indie-ulf. fixes #16449 for trunk git-svn-id: http://svn.automattic.com/wordpress/trunk@17385 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/pluggable.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php index 408234000..9bf35d70b 100644 --- a/wp-includes/pluggable.php +++ b/wp-includes/pluggable.php @@ -835,7 +835,7 @@ function check_admin_referer($action = -1, $query_arg = '_wpnonce') { $adminurl = strtolower(admin_url()); $referer = strtolower(wp_get_referer()); $result = isset($_REQUEST[$query_arg]) ? wp_verify_nonce($_REQUEST[$query_arg], $action) : false; - if ( !$result && !(-1 == $action && strpos($referer, $adminurl) !== false) ) { + if ( !$result && !(-1 == $action && strpos($referer, $adminurl) === 0) ) { wp_nonce_ays($action); die(); }