Changeset 9025

Show
Ignore:
Timestamp:
09/28/08 21:05:37 (2 months ago)
Author:
westi
Message:

Protect log out actions against CSRF. Props markjaquith and ionfish. Fixes #7790.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/wp-admin/admin-header.php

    r9021 r9025  
    151151<?php } ?> 
    152152 
    153 <div id="user_info"><p><?php printf(__('Howdy, <a href="%1$s">%2$s</a>!'), 'profile.php', $user_identity) ?> | <a href="<?php echo site_url('wp-login.php?action=logout', 'login') ?>" title="<?php _e('Log Out') ?>"><?php _e('Log Out'); ?></a> <?php if ( ! $is_opera ) { ?> | <span id="gears-menu"><a href="#" onclick="wpGears.message(1);return false;"><?php _e('Turbo') ?></a></span><?php } ?></p></div> 
     153<div id="user_info"><p><?php printf(__('Howdy, <a href="%1$s">%2$s</a>!'), 'profile.php', $user_identity) ?> | <a href="<?php echo wp_logout_url() ?>" title="<?php _e('Log Out') ?>"><?php _e('Log Out'); ?></a> <?php if ( ! $is_opera ) { ?> | <span id="gears-menu"><a href="#" onclick="wpGears.message(1);return false;"><?php _e('Turbo') ?></a></span><?php } ?></p></div> 
    154154 
    155155<?php 

  • trunk/wp-content/themes/classic/comments-popup.php

    r8999 r9025  
    6363<form action="<?php echo get_option('siteurl'); ?>/wp-comments-post.php" method="post" id="commentform"> 
    6464<?php if ( $user_ID ) : ?> 
    65 <p><?php printf(__('Logged in as %s.'), '<a href="'.get_option('siteurl').'/wp-admin/profile.php">'.$user_identity.'</a>'); ?> <a href="<?php echo get_option('siteurl'); ?>/wp-login.php?action=logout" title="<?php echo attribute_escape(__('Log out of this account')); ?>"><?php _e('Log out &raquo;'); ?></a></p> 
     65<p><?php printf(__('Logged in as %s.'), '<a href="'.get_option('siteurl').'/wp-admin/profile.php">'.$user_identity.'</a>'); ?> <a href="<?php echo wp_logout_url(); ?>" title="<?php echo attribute_escape(__('Log out of this account')); ?>"><?php _e('Log out &raquo;'); ?></a></p> 
    6666<?php else : ?> 
    6767    <p> 

  • trunk/wp-content/themes/classic/comments.php

    r8999 r9025  
    5050<?php if ( $user_ID ) : ?> 
    5151 
    52 <p><?php printf(__('Logged in as %s.'), '<a href="'.get_option('siteurl').'/wp-admin/profile.php">'.$user_identity.'</a>'); ?> <a href="<?php echo get_option('siteurl'); ?>/wp-login.php?action=logout" title="<?php _e('Log out of this account') ?>"><?php _e('Log out &raquo;'); ?></a></p> 
     52<p><?php printf(__('Logged in as %s.'), '<a href="'.get_option('siteurl').'/wp-admin/profile.php">'.$user_identity.'</a>'); ?> <a href="<?php echo wp_logout_url(get_permalink()); ?>" title="<?php _e('Log out of this account') ?>"><?php _e('Log out &raquo;'); ?></a></p> 
    5353 
    5454<?php else : ?> 

  • trunk/wp-content/themes/default/comments-popup.php

    r8999 r9025  
    6363<form action="<?php echo get_option('siteurl'); ?>/wp-comments-post.php" method="post" id="commentform"> 
    6464<?php if ( $user_ID ) : ?> 
    65     <p>Logged in as <a href="<?php echo get_option('siteurl'); ?>/wp-admin/profile.php"><?php echo $user_identity; ?></a>. <a href="<?php echo get_option('siteurl'); ?>/wp-login.php?action=logout" title="Log out of this account">Log out &raquo;</a></p> 
     65    <p>Logged in as <a href="<?php echo get_option('siteurl'); ?>/wp-admin/profile.php"><?php echo $user_identity; ?></a>. <a href="<?php echo wp_logout_url(get_permalink()); ?>" title="Log out of this account">Log out &raquo;</a></p> 
    6666<?php else : ?> 
    6767    <p> 

  • trunk/wp-content/themes/default/comments.php

    r8999 r9025  
    5959<?php if ( $user_ID ) : ?> 
    6060 
    61 <p>Logged in as <a href="<?php echo get_option('siteurl'); ?>/wp-admin/profile.php"><?php echo $user_identity; ?></a>. <a href="<?php echo get_option('siteurl'); ?>/wp-login.php?action=logout" title="Log out of this account">Log out &raquo;</a></p> 
     61<p>Logged in as <a href="<?php echo get_option('siteurl'); ?>/wp-admin/profile.php"><?php echo $user_identity; ?></a>. <a href="<?php echo wp_logout_url(get_permalink()); ?>" title="Log out of this account">Log out &raquo;</a></p> 
    6262 
    6363<?php else : ?> 

  • trunk/wp-includes/functions.php

    r9013 r9025  
    21462146        $trans['switch']['theme']      = array( __( 'Your attempt to switch to this theme: &quot;%s&quot; has failed.' ), 'use_id' ); 
    21472147 
     2148        $trans['log']['out']           = array( sprintf( __( 'You are attempting to log out of %s' ), get_bloginfo( 'sitename' ) ), false ); 
     2149 
    21482150        if ( isset( $trans[$verb][$noun] ) ) { 
    21492151            if ( !empty( $trans[$verb][$noun][1] ) ) { 
    …… 
    21792181    if ( wp_get_referer() ) 
    21802182        $html .= "</p><p><a href='" . remove_query_arg( 'updated', clean_url( wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>"; 
     2183    elseif ( 'log-out' == $action ) 
     2184        $html .= "</p><p>" . sprintf( __( "Do you really want to <a href='%s'>log out</a>?"), wp_nonce_url( site_url('wp-login.php?action=logout', 'login'), 'log-out' ) ); 
     2185 
    21812186    wp_die( $html, $title); 
    21822187} 

  • trunk/wp-includes/general-template.php

    r9019 r9025  
    105105function wp_loginout() { 
    106106    if ( ! is_user_logged_in() ) 
    107         $link = '<a href="' . site_url('wp-login.php', 'login') . '">' . __('Log in') . '</a>'; 
     107        $link = '<a href="' . wp_login_url() . '">' . __('Log in') . '</a>'; 
    108108    else 
    109         $link = '<a href="' . site_url('wp-login.php?action=logout', 'login') . '">' . __('Log out') . '</a>'; 
     109        $link = '<a href="' . wp_logout_url() . '">' . __('Log out') . '</a>'; 
    110110 
    111111    echo apply_filters('loginout', $link); 
     112} 
     113 
     114/** 
     115 * Returns the Log Out URL. 
     116 * 
     117 * Returns the URL that allows the user to log out of the site 
     118 * 
     119 * @since 2.7 
     120 * @uses wp_nonce_url() To protect against CSRF 
     121 * @uses site_url() To generate the log in URL 
     122 *  
     123 * @param string $redirect Path to redirect to on logout. 
     124 */ 
     125function wp_logout_url($redirect = '') { 
     126    if ( strlen($redirect) ) 
     127        $redirect = "&redirect_to=$redirect"; 
     128     
     129    return wp_nonce_url( site_url("wp-login.php?action=logout$redirect", 'login'), 'log-out' ); 
     130} 
     131 
     132/** 
     133 * Returns the Log In URL. 
     134 * 
     135 * Returns the URL that allows the user to log in to the site 
     136 * 
     137 * @since 2.7 
     138 * @uses site_url() To generate the log in URL 
     139 *  
     140 * @param string $redirect Path to redirect to on login. 
     141 */ 
     142function wp_login_url($redirect = '') { 
     143    if ( strlen($redirect) ) 
     144        $redirect = "?redirect_to=$redirect"; 
     145     
     146    return site_url("wp-login.php$redirect", 'login'); 
    112147} 
    113148 

  • trunk/wp-login.php

    r8952 r9025  
    273273 
    274274case 'logout' : 
    275  
     275    check_admin_referer('log-out'); 
    276276    wp_logout(); 
    277277