IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Properly return referrer when referer = true and echo = false. Props scribu, webduo. fixes #11953

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@18130 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan 2011-06-03 18:23:41 +00:00
parent f938faa814
commit e91971979b
1 changed files with 4 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
wp-includes/functions.php
View File

@ -1954,11 +1954,6 @@ function wp_nonce_url( $actionurl, $action = -1 ) {
* offer absolute protection, but should protect against most cases. It is very * offer absolute protection, but should protect against most cases. It is very
* important to use nonce field in forms. * important to use nonce field in forms.
* *
* If you set $echo to true and set $referer to true, then you will need to
* retrieve the {@link wp_referer_field() wp referer field}. If you have the
* $referer set to true and are echoing the nonce field, it will also echo the
* referer field.
*
* The $action and $name are optional, but if you want to have better security, * The $action and $name are optional, but if you want to have better security,
* it is strongly suggested to set those two parameters. It is easier to just * it is strongly suggested to set those two parameters. It is easier to just
* call the function without any parameters, because validation of the nonce * call the function without any parameters, because validation of the nonce
@ -1982,11 +1977,12 @@ function wp_nonce_url( $actionurl, $action = -1 ) {
function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) { function wp_nonce_field( $action = -1, $name = "_wpnonce", $referer = true , $echo = true ) {
$name = esc_attr( $name ); $name = esc_attr( $name );
$nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />'; $nonce_field = '<input type="hidden" id="' . $name . '" name="' . $name . '" value="' . wp_create_nonce( $action ) . '" />';
if ( $echo )
echo $nonce_field;
if ( $referer ) if ( $referer )
wp_referer_field( $echo ); $nonce_field .= wp_referer_field( false );
if ( $echo )
echo $nonce_field;
return $nonce_field; return $nonce_field;
} }