vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-16 23:00:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add nonce protection for setting/removing featured post image. fixes #13438

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@14730 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Mark Jaquith
2010-05-18 22:08:49 +00:00
parent b8a9ec8972
commit dafdd33220
8 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-admin/includes/post.php
+3 -3
View File
@@ -1138,8 +1138,7 @@ function get_sample_permalink_html( $id, $new_title = null, $new_slug = null ) {
* @return string html
*/
function _wp_post_thumbnail_html( $thumbnail_id = NULL ) {
global $content_width, $_wp_additional_image_sizes;
global $content_width, $_wp_additional_image_sizes, $post_ID;
$set_thumbnail_link = '<p class="hide-if-no-js"><a title="' . esc_attr__( 'Set featured image' ) . '" href="' . esc_url( get_upload_iframe_src('image') ) . '" id="set-post-thumbnail" class="thickbox">%s</a></p>';
$content = sprintf($set_thumbnail_link, esc_html__( 'Set featured image' ));
@@ -1151,8 +1150,9 @@ function _wp_post_thumbnail_html( $thumbnail_id = NULL ) {
else
$thumbnail_html = wp_get_attachment_image( $thumbnail_id, 'post-thumbnail' );
if ( !empty( $thumbnail_html ) ) {
$ajax_nonce = wp_create_nonce( "set_post_thumbnail-$post_ID" );
$content = sprintf($set_thumbnail_link, $thumbnail_html);
$content .= '<p class="hide-if-no-js"><a href="#" id="remove-post-thumbnail" onclick="WPRemoveThumbnail();return false;">' . esc_html__( 'Remove featured image' ) . '</a></p>';
$content .= '<p class="hide-if-no-js"><a href="#" id="remove-post-thumbnail" onclick="WPRemoveThumbnail(\'' . $ajax_nonce . '\');return false;">' . esc_html__( 'Remove featured image' ) . '</a></p>';
}
$content_width = $old_content_width;
}