Show
Ignore:
Timestamp:
03/07/06 01:47:45 (3 years ago)
Author:
ryan
Message:

Security back ports from masquerade and MarkJaquith?.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/1.5/wp-admin/admin.php

    r2592 r3627  
    5656         
    5757        if (! file_exists(ABSPATH . "wp-content/plugins/$plugin_page")) 
    58             die(sprintf(__('Cannot load %s.'), $plugin_page)); 
     58            die(sprintf(__('Cannot load %s.'), htmlentities($plugin_page))); 
    5959 
    6060        if (! isset($_GET['noheader'])) 

  • branches/1.5/wp-admin/post.php

    r2780 r3627  
    3030switch($action) { 
    3131case 'post': 
    32  
     32    check_admin_referer(); 
    3333    if ( !user_can_create_draft($user_ID) ) 
    3434        die( __('You are not allowed to create posts or drafts on this blog.') ); 
    …… 
    269269 
    270270case 'editpost': 
     271    check_admin_referer(); 
    271272    // die(var_dump('<pre>', $_POST)); 
    272273    if (!isset($blog_ID)) { 
    …… 
    496497 
    497498case 'confirmdeletecomment': 
    498  
     499    check_admin_referer(); 
    499500    require_once('./admin-header.php'); 
    500501 
    …… 
    591592 
    592593case 'mailapprovecomment': 
    593  
     594    check_admin_referer(); 
    594595    $comment = (int) $_GET['comment']; 
    595596 
    …… 
    611612 
    612613case 'approvecomment': 
    613  
     614    check_admin_referer(); 
    614615    $comment = (int) $_GET['comment']; 
    615616    $p = (int) $_GET['p']; 
    …… 
    640641 
    641642case 'editedcomment': 
    642  
     643    check_admin_referer(); 
    643644    $comment_ID = (int) $_POST['comment_ID']; 
    644645    $comment_post_ID = (int) $_POST['comment_post_ID']; 

  • branches/1.5/wp-admin/profile.php

    r2439 r3627  
    6565        if ( $pass1 != $pass2 ) 
    6666            die (__("<strong>ERROR</strong>: you typed two different passwords. Go back to correct that.")); 
    67         $newuser_pass = $pass1; 
     67        $newuser_pass = $wpdb->escape($pass1); 
    6868        $updatepassword = "user_pass=MD5('$newuser_pass'), "; 
    6969        wp_clearcookie(); 
    70         wp_setcookie($user_login, $newuser_pass); 
     70        wp_setcookie($user_login, $pass1); 
    7171    } 
    7272 

  • branches/1.5/wp-admin/user-edit.php

    r2489 r3627  
    2424switch ($action) { 
    2525case 'update': 
     26 
     27check_admin_referer(); 
    2628 
    2729get_currentuserinfo();