[wp-trac] [WordPress Trac] #47718: Verification of new admin email address can be bypassed via options.php

[WordPress Trac]

#47718: Verification of new admin email address can be bypassed via options.php
-----------------------------------------+-----------------------------
 Reporter:  pixolin                      |       Owner:  (none)
     Type:  defect (bug)                 |      Status:  new
 Priority:  normal                       |   Milestone:  Future Release
Component:  Options, Meta APIs           |     Version:
 Severity:  normal                       |  Resolution:
 Keywords:  needs-patch has-screenshots  |     Focuses:
-----------------------------------------+-----------------------------
Changes (by zodiac1978):

 * keywords:  needs-patch => needs-patch has-screenshots


Comment:

 I'm not sure if this is the right place for it, but I put the function in
 `/wp-includes/user.php`:

 {{{#!php
 <?php
 /**
  * Adds an admin notice alerting the user to be careful on the options.php
 page
  *
  * @since 5.3.0
  *
  * @global string $pagenow
  */
 function options_page_warning() {
         global $pagenow;

         if ( 'options.php' !== $pagenow ) {
                 return;
         }

         echo '<div class="notice notice-warning">';
         echo '<p><strong>' . __( 'WARNING!' ) . '</strong></p>';
         echo __( 'This page allows direct access to your site settings.
 You can break things here. Please be cautious!' );
         echo '</p></div>';

 }
 }}}

 And the filter in `/wp-admin/includes/admin-filters.php`:

 {{{#!php
 <?php
 add_action( 'admin_notices', 'options_page_warning' );
 }}}

 You can see the out in the screenshot.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/47718#comment:5>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform