Changeset 3771

Show
Ignore:
Timestamp:
05/11/06 23:05:45 (2 years ago)
Author:
ryan
Message:

Backport nonces and pluggable cookies.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/2.0/wp-admin/admin-functions.php

    r3748 r3771  
    644644    <td><a href="<?php the_permalink(); ?>" rel="permalink" class="edit"><?php _e('View'); ?></a></td> 
    645645    <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?action=edit&amp;post=$id' class='edit'>" . __('Edit') . "</a>"; } ?></td>  
    646     <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'page', " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('','',0), 1)) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
     646    <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='" . wp_nonce_url("post.php?action=delete&amp;post=$id", 'delete-page' . $id) .  "' class='delete' onclick=\"return deleteSomething( 'page', " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
    647647  </tr>  
    648648 

  • branches/2.0/wp-admin/admin.php

    r3608 r3771  
    1818update_category_cache(); 
    1919 
    20 get_currentuserinfo(); 
     20wp_get_current_user(); 
    2121 
    2222$posts_per_page = get_settings('posts_per_page'); 

  • branches/2.0/wp-admin/categories.php

    r3737 r3771  
    2626case 'addcat': 
    2727 
    28     check_admin_referer(); 
     28    check_admin_referer('add-category'); 
    2929 
    3030    if ( !current_user_can('manage_categories') ) 
    …… 
    3737 
    3838case 'delete': 
    39  
    40     check_admin_referer(); 
     39    $cat_ID = (int) $_GET['cat_ID']; 
     40    check_admin_referer('delete-category' .  $cat_ID); 
    4141 
    4242    if ( !current_user_can('manage_categories') ) 
    4343        die (__('Cheatin&#8217; uh?')); 
    4444 
    45     $cat_ID = (int) $_GET['cat_ID']; 
    4645    $cat_name = get_catname($cat_ID); 
    4746 
    …… 
    6564 <h2><?php _e('Edit Category') ?></h2> 
    6665 <form name="editcat" action="categories.php" method="post"> 
     66      <?php wp_nonce_field('update-category' .  $category->cat_ID); ?> 
    6767      <table class="editform" width="100%" cellspacing="2" cellpadding="5"> 
    6868        <tr> 
    …… 
    9797 
    9898case 'editedcat': 
    99     check_admin_referer(); 
     99    $cat_ID = (int) $_POST['cat_ID']; 
     100    check_admin_referer('update-category' . $cat_ID); 
    100101 
    101102    if ( !current_user_can('manage_categories') ) 
    …… 
    151152    <h2><?php _e('Add New Category') ?></h2> 
    152153    <form name="addcat" id="addcat" action="categories.php" method="post"> 
    153          
     154    <?php wp_nonce_field('add-category'); ?> 
    154155        <p><?php _e('Name:') ?><br /> 
    155156        <input type="text" name="cat_name" value="" /></p> 

  • branches/2.0/wp-admin/edit-comments.php

    r3755 r3771  
    4040<?php 
    4141if ( !empty( $_POST['delete_comments'] ) ) : 
    42     check_admin_referer(); 
     42    check_admin_referer('bulk-comments'); 
    4343 
    4444    $i = 0; 
    …… 
    9999            if ( current_user_can('edit_post', $comment->comment_post_ID) ) { 
    100100                echo " | <a href=\"post.php?action=editcomment&amp;comment=".$comment->comment_ID."\">" . __('Edit Comment') . "</a>"; 
    101                 echo " | <a href=\"post.php?action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return deleteSomething( 'comment', $comment->comment_ID, '" . sprintf(__("You are about to delete this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars( $comment->comment_author, 1 ))  . "' );\">" . __('Delete Comment') . "</a> &#8212; "; 
     101                echo ' | <a href="' . wp_nonce_url('comment.php?action=deletecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID, 'delete-comment' . $comment->comment_ID) . '" onclick="return deleteSomething( \'comment\', ' . $comment->comment_ID . ', \'' . sprintf(__("You are about to delete this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($comment->comment_author, 1)) . "' );\">" . __('Delete Comment') . '</a> '; 
    102102            } // end if any comments to show 
    103103            // Get post title 
    …… 
    127127 
    128128    if ($comments) { 
    129         echo '<form name="deletecomments" id="deletecomments" action="" method="post">  
    130         <table width="100%" cellpadding="3" cellspacing="3"> 
     129        echo '<form name="deletecomments" id="deletecomments" action="" method="post"> '; 
     130        wp_nonce_field('bulk-comments'); 
     131        echo '<table width="100%" cellpadding="3" cellspacing="3"> 
    131132  <tr> 
    132133    <th scope="col">*</th> 

  • branches/2.0/wp-admin/edit-form-advanced.php

    r3456 r3771  
    2323    $temp_ID = -1 * time(); 
    2424    $form_extra = "<input type='hidden' name='temp_ID' value='$temp_ID' />"; 
     25    wp_nonce_field('add-post'); 
    2526} else { 
    2627    $form_action = 'editpost'; 
    2728    $form_extra = "<input type='hidden' name='post_ID' value='$post_ID' />"; 
     29    wp_nonce_field('update-post' .  $post_ID); 
    2830} 
    2931 
    …… 
    221223if (current_user_can('upload_files')) { 
    222224    $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID); 
    223     $uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID"; 
     225    $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading'); 
    224226    $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src); 
    225227    if ( false != $uploading_iframe_src ) 

  • branches/2.0/wp-admin/edit-form-ajax-cat.php

    r3737 r3771  
    33require_once('admin-functions.php'); 
    44require_once('admin-db.php'); 
    5  
    6 get_currentuserinfo(); 
    75 
    86if ( !current_user_can('manage_categories') ) 

  • branches/2.0/wp-admin/edit-form-comment.php

    r3283 r3771  
    77 
    88<form name="post" action="post.php" method="post" id="post"> 
     9<?php wp_nonce_field('update-comment' . $comment->comment_ID) ?> 
    910<div class="wrap"> 
    1011<input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" /> 

  • branches/2.0/wp-admin/edit-link-form.php

    r3257 r3771  
    55    $submit_text = __('Save Changes &raquo;'); 
    66    $form = '<form action="" method="post" name="editlink" id="editlink">';  
     7    $nonce_action = 'update-bookmark' . $link_id; 
    78} else { 
    89    $editing = false; 
    …… 
    1011    $submit_text = __('Add Link &raquo;'); 
    1112    $form = '<form name="addlink" method="post" action="link-manager.php">'; 
     13    $nonce_action = 'add-bookmark'; 
    1214} 
    1315 
    …… 
    3436<div class="wrap">  
    3537  <?php echo $form ?> 
     38  <?php wp_nonce_field($nonce_action); ?> 
    3639  <h2><?php echo $heading ?></h2> 
    3740<fieldset class="options"> 

  • branches/2.0/wp-admin/edit-page-form.php

    r3456 r3771  
    66if (0 == $post_ID) { 
    77    $form_action = 'post'; 
     8    $nonce_action = 'add-post'; 
    89    $temp_ID = -1 * time(); 
    910    $form_extra = "<input type='hidden' name='temp_ID' value='$temp_ID' />"; 
    1011} else { 
    1112    $form_action = 'editpost'; 
    12     $form_extra = "<input type='hidden' name='post_ID' value='$post_ID' />"; 
     13    $nonce_action = 'update-post' . $post_ID; 
     14    $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />"; 
    1315} 
    1416 
    …… 
    2426 
    2527<?php 
     28wp_nonce_field($nonce_action); 
     29 
    2630if (isset($mode) && 'bookmarklet' == $mode) { 
    2731    echo '<input type="hidden" name="mode" value="bookmarklet" />'; 
    …… 
    187191if (current_user_can('upload_files')) { 
    188192    $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID); 
    189     $uploading_iframe_src = "inline-uploading.php?action=view&amp;post=$uploading_iframe_ID"; 
     193    $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading'); 
    190194    $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src); 
    191195    if ( false != $uploading_iframe_src ) 

  • branches/2.0/wp-admin/edit-pages.php

    r3555 r3771  
    5353    <td><a href="<?php the_permalink(); ?>" rel="permalink" class="edit"><?php _e('View'); ?></a></td> 
    5454    <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?action=edit&amp;post=$post->ID' class='edit'>" . __('Edit') . "</a>"; } ?></td>  
    55     <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='post.php?action=delete&amp;post=$post->ID' class='delete' onclick=\"return deleteSomething( 'page', " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('','',0), 1)) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
     55    <td><?php if ( current_user_can('edit_pages') ) { echo "<a href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post' . $post->ID) . "' class='delete' onclick=\"return deleteSomething( 'page', " . $id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; page.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('','',0), 1)) . "' );\">" . __('Delete') . "</a>"; } ?></td>  
    5656  </tr> 
    5757<?php 

  • branches/2.0/wp-admin/edit.php

    r3757 r3771  
    211211    case 'control_delete': 
    212212        ?> 
    213         <td><?php if ( current_user_can('edit_post',$post->ID) ) { echo "<a href='post.php?action=delete&amp;post=$id' class='delete' onclick=\"return deleteSomething( 'post', " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), wp_specialchars(get_the_title('', ''), 1) ) . "' );\">" . __('Delete') . "</a>"; } ?></td> 
     213        <td><?php if ( current_user_can('edit_post',$post->ID) ) { echo "<a href='" . wp_nonce_url("post.php?action=delete&amp;post=$id", 'delete-post' . $post->ID) . "' class='delete' onclick=\"return deleteSomething( 'post', " . $id . ", '" . sprintf(__("You are about to delete this post &quot;%s&quot;.\\n&quot;OK&quot; to delete, &quot;Cancel&quot; to stop."), addslashes(wp_specialchars(get_the_title(),'double')) ) . "' );\">" . __('Delete') . "</a>"; } ?></td> 
    214214        <?php 
    215215        break; 
    …… 
    263263            if ( current_user_can('edit_post', $post->ID) ) { 
    264264                echo "[ <a href=\"post.php?action=editcomment&amp;comment=".$comment->comment_ID."\">" .  __('Edit') . "</a>"; 
    265                 echo " - <a href=\"post.php?action=deletecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\" onclick=\"return confirm('" . sprintf(__("You are about to delete this comment by \'%s\'\\n  \'OK\' to delete, \'Cancel\' to stop."), wp_specialchars( $comment->comment_author, 1 )) . "')\">" . __('Delete') . "</a> "; 
     265                echo ' - <a href="' . wp_nonce_url('post.php?action=deletecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID, 'delete-comment' . $comment->comment_ID) . '" onclick="return confirm(\'' . sprintf(__("You are about to delete this comment by &quot;%s&quot;.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($comment->comment_author, 1)) . "');\">" . __('Delete') . '</a> '; 
     266 
    266267                if ( ('none' != $comment_status) && ( current_user_can('moderate_comments') ) ) { 
    267268                    if ('approved' == wp_get_comment_status($comment->comment_ID)) { 
    268                         echo " - <a href=\"post.php?action=unapprovecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\">" . __('Unapprove') . "</a> "; 
     269                        echo ' - <a href="' . wp_nonce_url('post.php?action=unapprovecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID, 'unapprove-comment' . $comment->comment_ID) . '">' . __('Unapprove') . '</a> '; 
    269270                    } else { 
    270                         echo " - <a href=\"post.php?action=approvecomment&amp;p=".$post->ID."&amp;comment=".$comment->comment_ID."\">" . __('Approve') . "</a> "; 
     271                        echo ' - <a href="' . wp_nonce_url('post.php?action=approvecomment&amp;p=' . $post->ID . '&amp;comment=' . $comment->comment_ID, 'approve-comment' . $comment->comment_ID) . '">' . __('Approve') . '</a> '; 
    271272                    } 
    272273                } 

  • branches/2.0/wp-admin/inline-uploading.php

    r3737 r3771  
    22 
    33require_once('admin.php'); 
    4  
    5 check_admin_referer(); 
    64 
    75header('Content-Type: text/html; charset=' . get_option('blog_charset')); 
    …… 
    3735case 'delete': 
    3836 
     37check_admin_referer('inlineuploading'); 
     38 
    3939if ( !current_user_can('edit_post', (int) $attachment) ) 
    4040    die(__('You are not allowed to delete this attachment.').' <a href="'.basename(__FILE__)."?post=$post&amp;all=$all&amp;action=upload\">".__('Go back').'</a>'); 
    …… 
    4242wp_delete_attachment($attachment); 
    4343 
    44 header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=$start"); 
     44header("Location: " . basename(__FILE__) ."?post=$post&all=$all&action=view&start=$start"); 
    4545die; 
    4646 
    4747case 'save': 
     48 
     49check_admin_referer('inlineuploading'); 
    4850 
    4951$overrides = array('action'=>'save'); 
    …… 
    101103} 
    102104 
    103 header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=0"); 
     105header("Location: " . basename(__FILE__) . "?post=$post&all=$all&action=view&start=0"); 
    104106die(); 
    105107 
    …… 
    140142 
    141143if ( count($attachments) == 0 ) { 
    142     header("Location: ".basename(__FILE__)."?post=$post&action=upload"); 
     144    header("Location: " . basename(__FILE__) ."?post=$post&action=upload" ); 
    143145    die; 
    144146} elseif ( count($attachments) > $num ) { 
    …… 
    214216"; 
    215217        $send_delete_cancel = "<a onclick=\"sendToEditor({$ID});return false;\" href=\"javascript:void()\">$__send_to_editor</a> 
    216 <a onclick=\"return confirm('$__confirmdelete')\" href=\"".basename(__FILE__)."?action=delete&amp;attachment={$ID}&amp;all=$all&amp;start=$start&amp;post=$post\">$__delete</a> 
     218<a onclick=\"return confirm('$__confirmdelete')\" href=\"" . wp_nonce_url( basename(__FILE__) . "?action=delete&amp;attachment={$ID}&amp;all=$all&amp;start=$start&amp;post=$post", inlineuploading) . "\">$__delete</a> 
    217219        <a onclick=\"popup.style.display='none';return false;\" href=\"javascript:void()\">$__close</a> 
    218220"; 
    …… 
    642644<body> 
    643645<ul id="upload-menu"> 
    644 <li<?php echo $current_1; ?>><a href="<?php echo basename(__FILE__); ?>?action=upload&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $start; ?>"><?php _e('Upload'); ?></a></li> 
     646<li<?php echo $current_1; ?>><a href="<?php echo basename(__FILE__) . "?action=upload&amp;post=$post&amp;all=$all&amp;start=$start"; ?>"><?php _e('Upload'); ?></a></li> 
    645647<?php if ( $attachments = $wpdb->get_results("SELECT ID FROM $wpdb->posts WHERE post_parent = '$post'") ) { ?> 
    646 <li<?php echo $current_2; ?>><a href="<?php echo basename(__FILE__); ?>?action=view&amp;post=<?php echo $post; ?>&amp;all=false"><?php _e('Browse'); ?></a></li> 
     648<li<?php echo $current_2; ?>><a href="<?php echo basename(__FILE__) . "?action=view&amp;post=$post&amp;all=false"; ?>"><?php _e('Browse'); ?></a></li> 
    647649<?php } ?> 
    648650<?php if ($wpdb->get_var("SELECT count(ID) FROM $wpdb->posts WHERE post_status = 'attachment'")) { ?> 
    649 <li<?php echo $current_3; ?>><a href="<?php echo basename(__FILE__); ?>?action=view&amp;post=<?php echo $post; ?>&amp;all=true"><?php _e('Browse All'); ?></a></li> 
     651<li<?php echo $current_3; ?>><a href="<?php echo basename(__FILE__) . "?action=view&amp;post=$post&amp;all=true"; ?>"><?php _e('Browse All'); ?></a></li> 
    650652<?php } ?> 
    651653<li> </li> 
    652654<?php if ( $action == 'view' ) { ?> 
    653655<?php if ( false !== $back ) : ?> 
    654 <li class="spacer"><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=0" title="<?php _e('First'); ?>">|&laquo;</a></li> 
    655 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $back; ?>"">&laquo; <?php _e('Back'); ?></a></li> 
     656<li class="spacer"><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=0"; ?>" title="<?php _e('First'); ?>">|&laquo;</a></li> 
     657<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=$back"; ?>">&laquo; <?php _e('Back'); ?></a></li> 
    656658<?php else : ?> 
    657659<li class="inactive spacer">|&laquo;</li> 
    …… 
    659661<?php endif; ?> 
    660662<?php if ( false !== $next ) : ?> 
    661 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $next; ?>"><?php _e('Next'); ?> &raquo;</a></li> 
    662 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;last=true" title="<?php _e('Last'); ?>">&raquo;|</a></li> 
     663<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=$next"; ?>"><?php _e('Next &raquo;'); ?></a></li> 
     664<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;last=true"; ?>" title="<?php _e('Last'); ?>">&raquo;|</a></li> 
    663665<?php else : ?> 
    664666<li class="inactive"><?php _e('Next'); ?> &raquo;</li> 
    …… 
    698700<input type="hidden" name="all" value="<?php echo $all; ?>" /> 
    699701<input type="hidden" name="start" value="<?php echo $start; ?>" /> 
     702<?php wp_nonce_field( 'inlineuploading' ); ?> 
    700703<div id="submit"> 
    701704<input type="submit" value="<?php _e('Upload'); ?>" /> 

  • branches/2.0/wp-admin/link-categories.php

    r3737 r3771  
    2727  case 'addcat': 
    2828  { 
    29       check_admin_referer(); 
     29      check_admin_referer('add-link-category'); 
    3030 
    3131      if ( !current_user_can('manage_links') ) 
    …… 
    8383  case 'Delete': 
    8484  { 
    85     check_admin_referer(); 
    86  
    87     $cat_id = (int) $_GET['cat_id']; 
     85       $cat_id = (int) $_GET['cat_id']; 
     86    check_admin_referer('delete-link-category' . $cat_id); 
     87 
    8888    $cat_name=get_linkcatname($cat_id); 
    8989 
    …… 
    117117 
    118118  <form name="editcat" method="post"> 
     119  <?php wp_nonce_field('update-link-category' . $row->cat_id) ?> 
    119120      <input type="hidden" name="action" value="editedcat" /> 
    120121      <input type="hidden" name="cat_id" value="<?php echo $row->cat_id ?>" /> 
    …… 
    204205  case "editedcat": 
    205206  { 
    206     check_admin_referer(); 
     207    $cat_id = (int)$_POST["cat_id"]; 
     208    check_admin_referer('update-link-category' . $cat_id); 
    207209 
    208210    if ( !current_user_can('manage_links') ) 
    …… 
    211213    $submit=$_POST["submit"]; 
    212214    if (isset($submit)) { 
    213  
    214     $cat_id = (int)$_POST["cat_id"]; 
    215215 
    216216    $cat_name= wp_specialchars($_POST["cat_name"]); 
    …… 
    357357                <td><?php echo $row->list_limit ?></td> 
    358358                <td><a href="link-categories.php?cat_id=<?php echo $row->cat_id?>&amp;action=Edit" class="edit"><?php _e('Edit') ?></a></td> 
    359                 <td><a href="link-categories.php?cat_id=<?php echo $row->cat_id?>&amp;action=Delete" onclick="return deleteSomething( 'link category', <?php echo $row->cat_id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; link category.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($row->cat_name,1)); ?>' );" class="delete"><?php _e('Delete') ?></a></td> 
     359                <td><a href="<?php echo wp_nonce_url("link-categories.php?cat_id=$row->cat_id?>&amp;action=Delete", 'delete-link-category' . $row->cat_id) ?>" "onclick="return deleteSomething( 'link category', <?php echo $row->cat_id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; link category.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($row->cat_name,1)); ?>' );" class="delete"><?php _e('Delete') ?></a></td> 
    360360              </tr> 
    361361<?php 
    …… 
    372372<div class="wrap"> 
    373373    <form name="addcat" method="post"> 
     374    <?php wp_nonce_field('add-link-category'); ?> 
    374375      <input type="hidden" name="action" value="addcat" /> 
    375376      <h2><?php _e('Add a Link Category:') ?></h2> 

  • branches/2.0/wp-admin/link-import.php

    r3737 r3771  
    2525<h2><?php _e('Import your blogroll from another system') ?> </h2> 
    2626<form enctype="multipart/form-data" action="link-import.php" method="post" name="blogroll"> 
     27<?php wp_nonce_field('import-bookmarks') ?> 
    2728 
    2829<p><?php _e('If a program or website you use allows you to export your links or subscriptions as OPML you may import them here.'); ?> 
    …… 
    6465 
    6566    case 1: { 
    66         check_admin_referer(); 
     67        check_admin_referer('import-bookmarks'); 
    6768 
    6869                include_once('admin-header.php'); 

  • branches/2.0/wp-admin/link-manager.php

    r3422 r3771  
    4040  case 'assign': 
    4141  { 
    42     check_admin_referer(); 
     42   check_admin_referer('bulk-bookmarks'); 
    4343 
    4444    // check the current user's level first. 
    …… 
    6868  case 'visibility': 
    6969  { 
    70     check_admin_referer(); 
     70  check_admin_referer('bulk-bookmarks'); 
    7171 
    7272    // check the current user's level first. 
    …… 
    105105  case 'move': 
    106106  { 
    107     check_admin_referer(); 
     107   check_admin_referer('bulk-bookmarks'); 
    108108 
    109109    // check the current user's level first. 
    …… 
    126126  case 'Add': 
    127127  { 
    128     check_admin_referer(); 
     128  check_admin_referer('add-bookmark'); 
    129129 
    130130    add_link(); 
    …… 
    136136  case 'editlink': 
    137137  { 
    138   
    139     check_admin_referer(); 
     138    $link_id = (int) $_POST['link_id']; 
     139    check_admin_referer('update-bookmark' . $link_id); 
    140140     
    141141    if (isset($links_show_cat_id) && ($links_show_cat_id != '')) 
    …… 
    148148    $links_show_cat_id = $cat_id; 
    149149 
    150     $link_id = (int) $_POST['link_id']; 
    151150    edit_link($link_id); 
    152151     
    …… 
    158157  case 'Delete': 
    159158  { 
    160     check_admin_referer(); 
     159    $link_id = (int) $_GET['link_id']; 
     160    check_admin_referer('delete-bookmark' . $link_id); 
    161161 
    162162    if ( !current_user_can('manage_links') ) 
    163163      die (__("Cheatin' uh ?")); 
    164  
    165     $link_id = (int) $_GET['link_id']; 
    166164 
    167165    wp_delete_link($link_id); 
    …… 
    321319<div class="wrap"> 
    322320 
     321    <?php wp_nonce_field('bulk-bookmarks') ?> 
    323322    <input type="hidden" name="link_id" value="" /> 
    324323    <input type="hidden" name="action" value="" /> 
    …… 
    384383            if ($show_buttons) { 
    385384        echo '<td><a href="link-manager.php?link_id=' . $link->link_id . '&amp;action=linkedit" class="edit">' . __('Edit') . '</a></td>'; 
    386         echo '<td><a href="link-manager.php?link_id=' . $link->link_id . '&amp;action=Delete"' .  " onclick=\"return deleteSomething( 'link', $link->link_id , '" . sprintf(__("You are about to delete the &quot;%s&quot; link to %s.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($link->link_name,1), wp_specialchars($link->link_url)) . '\' );" class="delete">' . __('Delete') . '</a></td>'; 
     385       echo '<td><a href="' . wp_nonce_url('link-manager.php?link_id='.$link->link_id.'&amp;action=delete', 'delete-bookmark' . $link->link_id ) . '"'." class='delete' onclick=\"return deleteSomething( 'link', $link->link_id , '".sprintf(__("You are about to delete the &quot;%s&quot; bookmark to %s.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), wp_specialchars($link->link_name, 1), wp_specialchars($link->link_url)).'\' );" class="delete">'.__('Delete').'</a></td>'; 
    387386        echo '<td><input type="checkbox" name="linkcheck[]" value="' . $link->link_id . '" /></td>'; 
    388387            } else { 
    389388              echo "<td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td>\n"; 
    390389            } 
     390 
    391391        echo "\n    </tr>\n"; 
    392392        } 

  • branches/2.0/wp-admin/list-manipulation.php

    r3737 r3771  
    44require_once('admin-db.php'); 
    55 
    6 get_currentuserinfo(); 
    76if ( !is_user_logged_in() ) 
    87    die('-1'); 

  • branches/2.0/wp-admin/moderation.php

    r3737 r3771  
    3333case 'update': 
    3434 
    35     check_admin_referer(); 
     35    check_admin_referer('moderate-comments'); 
    3636 
    3737    if ( ! current_user_can('moderate_comments') ) 
    …… 
    133133    <h2><?php _e('Moderation Queue') ?></h2> 
    134134    <form name="approval" action="moderation.php" method="post"> 
     135    <?php wp_nonce_field('moderate-comments') ?> 
    135136    <input type="hidden" name="action" value="update" /> 
    136137    <ol id="the-list" class="commentlist"> 

  • branches/2.0/wp-admin/options-discussion.php

    r3345 r3771  
    2222<h2><?php _e('Discussion Options') ?></h2>  
    2323<form method="post" action="options.php">  
     24<?php wp_nonce_field('update-options') ?> 
    2425<fieldset class="options"> 
    2526<legend><?php _e('Usual settings for an article:<br /><small><em>(These settings may be overridden for individual articles.)</em></small>') ?></legend>  

  • branches/2.0/wp-admin/options-general.php

    r3422 r3771  
    1111<h2><?php _e('General Options') ?></h2> 
    1212<form method="post" action="options.php">  
     13<?php wp_nonce_field('update-options') ?> 
    1314<table class="optiontable">  
    1415<tr valign="top">  

  • branches/2.0/wp-admin/options-misc.php

    r3437 r3771  
    1212<h2><?php _e('Miscellaneous Options') ?></h2>  
    1313<form method="post" action="options.php"> 
    14  
     14<?php wp_nonce_field('update-options') ?> 
    1515<fieldset class="options"> 
    1616<legend><?php _e('Uploading'); ?></legend> 

  • branches/2.0/wp-admin/options-permalink.php

    r3737 r3771  
    5858$home_path = get_home_path(); 
    5959 
    60 if ( isset($_POST) ) { 
    61     check_admin_referer(); 
     60if ( isset($_POST['permalink_structure']) || isset($_POST['category_base']) ) { 
     61    check_admin_referer('update-permalink'); 
    6262 
    6363    if ( isset($_POST['permalink_structure']) ) { 
    …… 
    118118?> 
    119119<form name="form" action="options-permalink.php" method="post">  
     120<?php wp_nonce_field('update-permalink') ?> 
    120121<h3><?php _e('Common options:'); ?></h3> 
    121122<p> 
    …… 
    166167  <p><?php _e('If your <code>.htaccess</code> file were <a href="http://codex.wordpress.org/Make_a_Directory_Writable">writable</a>, we could do this automatically, but it isn&#8217;t so these are the mod_rewrite rules you should have in your <code>.htaccess</code> file. Click in the field and press <kbd>CTRL + a</kbd> to select all.') ?></p> 
    167168<form action="options-permalink.php" method="post"> 
     169<?php wp_nonce_field('update-permalink') ?> 
    168170   <p> 
    169171<textarea rows="5" style="width: 98%;" name="rules"><?php echo $wp_rewrite->mod_rewrite_rules(); ?> 

  • branches/2.0/wp-admin/options-reading.php

    r3112 r3771  
    1010<div class="wrap">  
    1111<h2><?php _e('Reading Options') ?></h2>  
    12 <form name="form1" method="post" action="options.php">  
     12<form name="form1" method="post" action="options.php"> 
     13<?php wp_nonce_field('update-options') ?> 
     14 
    1315<fieldset class="options">  
    1416<legend><?php _e('Blog Pages') ?></legend>  

  • branches/2.0/wp-admin/options-writing.php

    r3223 r3771  
    1111<h2><?php _e('Writing Options') ?></h2>  
    1212<form method="post" action="options.php">  
     13<?php wp_nonce_field('update-options') ?> 
    1314<table width="100%" cellspacing="2" cellpadding="5" class="editform">  
    1415<tr valign="top">  

  • branches/2.0/wp-admin/options.php

    r3413 r3771  
    3030    $any_changed = 0; 
    3131     
    32     check_admin_referer(); 
     32    check_admin_referer('update-options'); 
    3333 
    3434    if (!$_POST['page_options']) { 
    …… 
    6969                // If home changed, write rewrite rules to new location. 
    7070                $wp_rewrite->flush_rules(); 
    71                 // Get currently logged in user and password. 
    72                 get_currentuserinfo(); 
    7371                // Clear cookies for old paths. 
    7472                wp_clearcookie(); 
    …… 
    9290  <h2><?php _e('All options'); ?></h2> 
    9391  <form name="form" action="options.php" method="post"> 
     92  <?php wp_nonce_field('update-options') ?> 
    9493  <input type="hidden" name="action" value="update" /> 
    9594  <table width="98%"> 

  • branches/2.0/wp-admin/page-new.php

    r2762 r3771  
    1414if ( current_user_can('edit_pages') ) { 
    1515    $action = 'post'; 
    16     get_currentuserinfo(); 
    17      
    1816    $post = get_default_post_to_edit(); 
    1917    $post->post_status = 'static'; 

  • branches/2.0/wp-admin/plugin-editor.php

    r3737 r3771  
    3535case 'update': 
    3636 
    37     check_admin_referer(); 
     37    check_admin_referer('edit-plugin' . $file); 
    3838 
    3939    if ( !current_user_can('edit_plugins') ) 
    …… 
    9898    <?php   if (!$error) { ?>  
    9999  <form name="template" id="template" action="plugin-editor.php" method="post"> 
     100  <?php wp_nonce_field('edit-plugin' . $file) ?> 
    100101         <div><textarea cols="70" rows="25" name="newcontent" id="newcontent" tabindex="1"><?php echo $content ?></textarea>  
    101102     <input type="hidden" name="action" value="update" />  

  • branches/2.0/wp-admin/plugins.php

    r3479 r3771  
    33 
    44if ( isset($_GET['action']) ) { 
    5     check_admin_referer(); 
    6      
    75    if ('activate' == $_GET['action']) { 
     6        check_admin_referer('activate-plugin' . $_GET['plugin']); 
    87        $current = get_settings('active_plugins'); 
    98        if (!in_array($_GET['plugin'], $current)) { 
    …… 
    1615        header('Location: plugins.php?activate=true'); 
    1716    } else if ('deactivate' == $_GET['action']) { 
     17        check_admin_referer('deactivate-plugin' . $_GET['plugin']); 
    1818        $current = get_settings('active_plugins'); 
    1919        array_splice($current, array_search( $_GET['plugin'], $current), 1 ); // Array-fu! 
    …… 
    9999 
    100100        if (!empty($current_plugins) && in_array($plugin_file, $current_plugins)) { 
    101             $action = "<a href='plugins.php?action=deactivate&amp;plugin=$plugin_file' title='".__('Deactivate this plugin')."' class='delete'>".__('Deactivate')."</a>"; 
     101            $action = "<a href='" . wp_nonce_url("plugins.php?action=deactivate&amp;plugin=$plugin_file", 'deactivate-plugin' . $plugin_file) . "' title='".__('Deactivate this plugin')."' class='delete'>".__('Deactivate')."</a>"; 
    102102            $plugin_data['Title'] = "<strong>{$plugin_data['Title']}</strong>"; 
    103103            $style .= $style == 'alternate' ? ' active' : 'active'; 
    104104        } else { 
    105             $action = "<a href='plugins.php?action=activate&amp;plugin=$plugin_file' title='".__('Activate this plugin')."' class='edit'>".__('Activate')."</a>"; 
     105            $action = "<a href='" . wp_nonce_url("plugins.php?action=activate&amp;plugin=$plugin_file", 'activate-plugin' . $plugin_file) . "' title='".__('Activate this plugin')."' class='edit'>".__('Activate')."</a>"; 
    106106        } 
    107107        $plugin_data['Description'] = wp_kses($plugin_data['Description'], array('a' => array('href' => array(),'title' => array()),'abbr' => array('title' => array()),'acronym' => array('title' => array()),'code' => array(),'em' => array(),'strong' => array()) ); ; 

  • branches/2.0/wp-admin/post.php

    r3737 r3771  
    3131switch($action) { 
    3232case 'post': 
    33     check_admin_referer(); 
     33    check_admin_referer('add-post'); 
    3434     
    3535    $post_ID = write_post(); 
    …… 
    8888 
    8989case 'editattachment': 
    90     check_admin_referer(); 
    91  
    9290    $post_id = (int) $_POST['post_ID']; 
     91 
     92    check_admin_referer('update-attachment' . $post_id); 
    9393 
    9494    // Don't let these be changed 
    …… 
    106106 
    107107case 'editpost': 
    108     check_admin_referer(); 
     108    $post_ID = (int) $_POST['post_ID']; 
     109    check_admin_referer('update-post' . $post_ID); 
    109110     
    110111    $post_ID = edit_post(); 
    …… 
    131132 
    132133case 'delete': 
    133     check_admin_referer(); 
    134  
    135134    $post_id = (isset($_GET['post']))  ? intval($_GET['post']) : intval($_POST['post_ID']); 
     135    check_admin_referer('delete-post' . $post_id); 
    136136 
    137137    $post = & get_post($post_id); 
    …… 
    213213 
    214214case 'deletecomment': 
    215  
    216     check_admin_referer(); 
    217  
    218     $comment = (int) $_GET['comment']; 
     215    $comment = (int) $_GET['comment']; 
     216    check_admin_referer('delete-comment' . $comment); 
     217 
    219218    $p = (int) $_GET['p']; 
    220219    if (isset($_GET['noredir'])) { 
    …… 
    244243 
    245244case 'unapprovecomment': 
    246  
    247     check_admin_referer(); 
    248  
    249     $comment = (int) $_GET['comment']; 
     245    $comment = (int) $_GET['comment']; 
     246    check_admin_referer('unapprove-comment' . $comment); 
     247 
    250248    $p = (int) $_GET['p']; 
    251249    if (isset($_GET['noredir'])) { 
    …… 
    272270 
    273271case 'mailapprovecomment': 
    274  
    275     $comment = (int) $_GET['comment']; 
     272    $comment = (int) $_GET['comment']; 
     273    check_admin_referer('approve-comment' . $comment); 
    276274 
    277275    if ( ! $comment = get_comment($comment) ) 
    …… 
    292290 
    293291case 'approvecomment': 
    294  
    295     check_admin_referer(); 
    296  
    297     $comment = (int) $_GET['comment']; 
     292    $comment = (int) $_GET['comment']; 
     293    check_admin_referer('approve-comment' . $comment); 
     294 
    298295    $p = (int) $_GET['p']; 
    299296    if (isset($_GET['noredir'])) { 
    …… 
    325322case 'editedcomment': 
    326323 
    327     check_admin_referer(); 
     324    check_admin_referer('update-comment'); 
    328325 
    329326    edit_comment(); 

  • branches/2.0/wp-admin/profile-update.php

    r3112 r3771  
    33require_once('admin.php'); 
    44 
    5 check_admin_referer(); 
     5check_admin_referer('update-profile' . $user_ID); 
    66 
    77if ( !$_POS