vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-12 12:50:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Protect log out actions against CSRF. Props markjaquith and ionfish. Fixes #7790.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@9025 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Peter Westwood
2008-09-28 21:05:37 +00:00
parent bf84bcef95
commit 15f99a6338
8 changed files with 48 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-includes/functions.php
+5
View File
@@ -2145,6 +2145,8 @@ function wp_explain_nonce( $action ) {
$trans['edit']['theme'] = array( __( 'Your attempt to edit this theme file: "%s" has failed.' ), 'use_id' );
$trans['switch']['theme'] = array( __( 'Your attempt to switch to this theme: "%s" has failed.' ), 'use_id' );
$trans['log']['out'] = array( sprintf( __( 'You are attempting to log out of %s' ), get_bloginfo( 'sitename' ) ), false );
if ( isset( $trans[$verb][$noun] ) ) {
if ( !empty( $trans[$verb][$noun][1] ) ) {
$lookup = $trans[$verb][$noun][1];
@@ -2178,6 +2180,9 @@ function wp_nonce_ays( $action ) {
$html = wp_specialchars( wp_explain_nonce( $action ) );
if ( wp_get_referer() )
$html .= "</p><p><a href='" . remove_query_arg( 'updated', clean_url( wp_get_referer() ) ) . "'>" . __( 'Please try again.' ) . "</a>";
elseif ( 'log-out' == $action )
$html .= "</p><p>" . sprintf( __( "Do you really want to <a href='%s'>log out</a>?"), wp_nonce_url( site_url('wp-login.php?action=logout', 'login'), 'log-out' ) );
wp_die( $html, $title);
}