Navigation

wp-comments-post.php

Timestamp:

03/14/07 23:13:36 (1 year ago)

Author:

markjaquith

Message:

nonce-protect comments by users with unfiltered_html cap to prevent xsrf/xss. fixes #3973 for 2.0

Files:

r4261	r5041
26	26	// If the user is logged in
27	27	$user = wp_get_current_user();
28		if ( $user->ID ) :
	28	if ( $user->ID ) {
29	29	$comment_author = $wpdb->escape($user->display_name);
30	30	$comment_author_email = $wpdb->escape($user->user_email);
31	31	$comment_author_url = $wpdb->escape($user->user_url);
32		else :
	32	if ( current_user_can('unfiltered_html') ) {
	33	if ( wp_create_nonce('unfiltered-html-comment_' . $comment_post_ID) != $_POST['_wp_unfiltered_html_comment'] ) {
	34	kses_remove_filters(); // start with a clean slate
	35	kses_init_filters(); // set up the filters
	36	}
	37	}
	38	} else {
33	39	if ( get_option('comment_registration') )
34	40	die( __('Sorry, you must be logged in to post a comment.') );
35		endif;
	41	}
36	42
37	43	$comment_type = '';