<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[34059] trunk/src: Introduce `wp_validate_action( $action = '' )`, a helper function that checks `$_REQUEST` for `action` and returns it, or empty string if not present.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/34059">34059</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/34059","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>wonderboymusic</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2015-09-11 21:07:45 +0000 (Fri, 11 Sep 2015)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Introduce `wp_validate_action( $action = '' )`, a helper function that checks `$_REQUEST` for `action` and returns it, or empty string if not present. If `$action` is passed, it checks to make sure they match before returning it, or an empty string. Strings are always returned to avoid returning multiple types.
Implementing this removes 27 uses of direct superglobal access in the admin.
For more reading:
https://codeclimate.com/github/WordPress/WordPress/wp-admin/edit-comments.php
See <a href="https://core.trac.wordpress.org/ticket/33837">#33837</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpadminadminpostphp">trunk/src/wp-admin/admin-post.php</a></li>
<li><a href="#trunksrcwpadminadminphp">trunk/src/wp-admin/admin.php</a></li>
<li><a href="#trunksrcwpadminasyncuploadphp">trunk/src/wp-admin/async-upload.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswptermslisttablephp">trunk/src/wp-admin/includes/class-wp-terms-list-table.php</a></li>
<li><a href="#trunksrcwpadminnetworksiteinfophp">trunk/src/wp-admin/network/site-info.php</a></li>
<li><a href="#trunksrcwpadminnetworksitenewphp">trunk/src/wp-admin/network/site-new.php</a></li>
<li><a href="#trunksrcwpadminnetworksitesettingsphp">trunk/src/wp-admin/network/site-settings.php</a></li>
<li><a href="#trunksrcwpadminnetworkusernewphp">trunk/src/wp-admin/network/user-new.php</a></li>
<li><a href="#trunksrcwpadminnetworkusersphp">trunk/src/wp-admin/network/users.php</a></li>
<li><a href="#trunksrcwpadminupdatephp">trunk/src/wp-admin/update.php</a></li>
<li><a href="#trunksrcwpadminusernewphp">trunk/src/wp-admin/user-new.php</a></li>
<li><a href="#trunksrcwpincludesfunctionsphp">trunk/src/wp-includes/functions.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpadminadminpostphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/admin-post.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/admin-post.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/admin-post.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -28,7 +28,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> /** This action is documented in wp-admin/admin.php */
</span><span class="cx" style="display: block; padding: 0 10px"> do_action( 'admin_init' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-$action = empty( $_REQUEST['action'] ) ? '' : $_REQUEST['action'];
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = wp_validate_action();
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! wp_validate_auth_cookie() ) {
</span><span class="cx" style="display: block; padding: 0 10px"> if ( empty( $action ) ) {
</span></span></pre></div>
<a id="trunksrcwpadminadminphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/admin.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/admin.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/admin.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -358,14 +358,16 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( ! empty( $_REQUEST['action'] ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$_action = wp_validate_action();
+if ( ! empty( $_action ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Fires when an 'action' request variable is sent.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * The dynamic portion of the hook name, `$_REQUEST['action']`,
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * The dynamic portion of the hook name, `$_action`,
</ins><span class="cx" style="display: block; padding: 0 10px"> * refers to the action derived from the `GET` or `POST` request.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @since 2.6.0
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- do_action( 'admin_action_' . $_REQUEST['action'] );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ do_action( 'admin_action_' . $_action );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+unset( $_action );
</ins></span></pre></div>
<a id="trunksrcwpadminasyncuploadphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/async-upload.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/async-upload.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/async-upload.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -6,6 +6,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @subpackage Administration
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+// `wp_validate_action()` isn't loaded yet
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
</span><span class="cx" style="display: block; padding: 0 10px"> define( 'DOING_AJAX', true );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -19,7 +20,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> else
</span><span class="cx" style="display: block; padding: 0 10px"> require_once( dirname( dirname( __FILE__ ) ) . '/wp-load.php' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( ! ( isset( $_REQUEST['action'] ) && 'upload-attachment' == $_REQUEST['action'] ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+if ( ! wp_validate_action( 'upload-attachment' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> // Flash often fails to send cookies with the POST or upload, so we need to pass it in GET or POST instead
</span><span class="cx" style="display: block; padding: 0 10px"> if ( is_ssl() && empty($_COOKIE[SECURE_AUTH_COOKIE]) && !empty($_REQUEST['auth_cookie']) )
</span><span class="cx" style="display: block; padding: 0 10px"> $_COOKIE[SECURE_AUTH_COOKIE] = $_REQUEST['auth_cookie'];
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -34,7 +35,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> header( 'Content-Type: text/html; charset=' . get_option( 'blog_charset' ) );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( isset( $_REQUEST['action'] ) && 'upload-attachment' === $_REQUEST['action'] ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+if ( wp_validate_action( 'upload-attachment' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> include( ABSPATH . 'wp-admin/includes/ajax-actions.php' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> send_nosniff_header();
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswptermslisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-terms-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-terms-list-table.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/includes/class-wp-terms-list-table.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -153,7 +153,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @return string
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px"> public function current_action() {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( isset( $_REQUEST['action'] ) && isset( $_REQUEST['delete_tags'] ) && ( 'delete' == $_REQUEST['action'] || 'delete' == $_REQUEST['action2'] ) )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $action = wp_validate_action();
+ if ( $action && isset( $_REQUEST['delete_tags'] ) && ( 'delete' == $action || 'delete' == $_REQUEST['action2'] ) )
</ins><span class="cx" style="display: block; padding: 0 10px"> return 'bulk-delete';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> return parent::current_action();
</span></span></pre></div>
<a id="trunksrcwpadminnetworksiteinfophp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/network/site-info.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/network/site-info.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/network/site-info.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -53,7 +53,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $parsed_scheme = parse_url( $details->siteurl, PHP_URL_SCHEME );
</span><span class="cx" style="display: block; padding: 0 10px"> $is_main_site = is_main_site( $id );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( isset( $_REQUEST['action'] ) && 'update-site' == $_REQUEST['action'] ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+if ( wp_validate_action( 'update-site' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer( 'edit-site' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> switch_to_blog( $id );
</span></span></pre></div>
<a id="trunksrcwpadminnetworksitenewphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/network/site-new.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/network/site-new.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/network/site-new.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -33,7 +33,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> '<p>' . __('<a href="https://wordpress.org/support/forum/multisite/" target="_blank">Support Forums</a>') . '</p>'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( isset($_REQUEST['action']) && 'add-site' == $_REQUEST['action'] ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+if ( wp_validate_action( 'add-site' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer( 'add-blog', '_wpnonce_add-blog' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! is_array( $_POST['blog'] ) )
</span></span></pre></div>
<a id="trunksrcwpadminnetworksitesettingsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/network/site-settings.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/network/site-settings.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/network/site-settings.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -48,7 +48,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $is_main_site = is_main_site( $id );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( isset($_REQUEST['action']) && 'update-site' == $_REQUEST['action'] && is_array( $_POST['option'] ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+if ( wp_validate_action( 'update-site' ) && is_array( $_POST['option'] ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer( 'edit-site' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> switch_to_blog( $id );
</span></span></pre></div>
<a id="trunksrcwpadminnetworkusernewphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/network/user-new.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/network/user-new.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/network/user-new.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -30,7 +30,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> '<p>' . __('<a href="https://wordpress.org/support/forum/multisite/" target="_blank">Support Forums</a>') . '</p>'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( isset($_REQUEST['action']) && 'add-user' == $_REQUEST['action'] ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+if ( wp_validate_action( 'add-user' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer( 'add-user', '_wpnonce_add-user' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! current_user_can( 'manage_network_users' ) )
</span></span></pre></div>
<a id="trunksrcwpadminnetworkusersphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/network/users.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/network/users.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/network/users.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -174,11 +174,12 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> require_once( ABSPATH . 'wp-admin/admin-header.php' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( isset( $_REQUEST['updated'] ) && $_REQUEST['updated'] == 'true' && ! empty( $_REQUEST['action'] ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = wp_validate_action();
+if ( isset( $_REQUEST['updated'] ) && $_REQUEST['updated'] == 'true' && ! empty( $action ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <div id="message" class="updated notice is-dismissible"><p>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- switch ( $_REQUEST['action'] ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ switch ( $action ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> case 'delete':
</span><span class="cx" style="display: block; padding: 0 10px"> _e( 'User deleted.' );
</span><span class="cx" style="display: block; padding: 0 10px"> break;
</span></span></pre></div>
<a id="trunksrcwpadminupdatephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/update.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/update.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/update.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -17,7 +17,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( isset($_GET['action']) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $plugin = isset($_REQUEST['plugin']) ? trim($_REQUEST['plugin']) : '';
</span><span class="cx" style="display: block; padding: 0 10px"> $theme = isset($_REQUEST['theme']) ? urldecode($_REQUEST['theme']) : '';
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $action = isset($_REQUEST['action']) ? $_REQUEST['action'] : '';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $action = wp_validate_action();
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( 'update-selected' == $action ) {
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! current_user_can( 'update_plugins' ) )
</span></span></pre></div>
<a id="trunksrcwpadminusernewphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/user-new.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/user-new.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-admin/user-new.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -29,7 +29,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> add_filter( 'wpmu_signup_user_notification_email', 'admin_created_user_email' );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-if ( isset($_REQUEST['action']) && 'adduser' == $_REQUEST['action'] ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+if ( wp_validate_action( 'adduser' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer( 'add-user', '_wpnonce_add-user' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $user_details = null;
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -101,7 +101,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> wp_redirect( $redirect );
</span><span class="cx" style="display: block; padding: 0 10px"> die();
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-} elseif ( isset($_REQUEST['action']) && 'createuser' == $_REQUEST['action'] ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+} elseif ( wp_validate_action( 'createuser' ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> check_admin_referer( 'create-user', '_wpnonce_create-user' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! current_user_can( 'create_users' ) ) {
</span></span></pre></div>
<a id="trunksrcwpincludesfunctionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/functions.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/functions.php 2015-09-11 20:48:47 UTC (rev 34058)
+++ trunk/src/wp-includes/functions.php 2015-09-11 21:07:45 UTC (rev 34059)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -4980,3 +4980,26 @@
</span><span class="cx" style="display: block; padding: 0 10px"> </script>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
+/**
+ * Retrieve and, optionally, validate, an `action` query var
+ *
+ * @since 4.4.0
+ *
+ * @param string $action Optional. Action to validate.
+ * @return string Empty string if there is no action in the request or it doesn't
+ * match the passed `$action`. Returns the [passed `$action` or
+ * request action on succcess.
+ */
+function wp_validate_action( $action = '' ) {
+ $r = $_REQUEST;
+ if ( ! isset( $r['action'] ) ) {
+ return '';
+ }
+
+ if ( ! empty( $action ) ) {
+ return $action === $r['action'] ? $action : '';
+ }
+
+ return $r['action'];
+}
</ins><span class="cx" style="display: block; padding: 0 10px">\ No newline at end of file
</span></span></pre>
</div>
</div>
</body>
</html>