IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add Nonce to updating wporg_favorites user meta field

Browse Source 
Built from https://develop.svn.wordpress.org/trunk@37145


git-svn-id: http://core.svn.wordpress.org/trunk@37112 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Aaron Jorbin
2016-03-30 18:36:26 +00:00
parent 9b7a775413
commit bd7ffca854
7 changed files with 27 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
wp-admin/includes/plugin-install.php
View File

@@ -300,7 +300,8 @@ function install_plugins_upload() {
*
*/
function install_plugins_favorites_form() {
$user = ! empty( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
$user = get_user_option( 'wporg_favorites' );
$action = 'save_wporg_username_' . get_current_user_id();
?>
<p class="install-help"><?php _e( 'If you have marked plugins as favorites on WordPress.org, you can browse them here.' ); ?></p>
<form method="get">
@@ -309,6 +310,7 @@ function install_plugins_favorites_form() {
<label for="user"><?php _e( 'Your WordPress.org username:' ); ?></label>
<input type="search" id="user" name="user" value="<?php echo esc_attr( $user ); ?>" />
<input type="submit" class="button" value="<?php esc_attr_e( 'Get Favorites' ); ?>" />
<input type="hidden" id="wporg-username-nonce" name="_wpnonce" value="<?php echo esc_attr( wp_create_nonce( $action ) ); ?>" />
</p>
</form>
<?php