WordPress.org
Get WordPress

Plugin Directory

Changeset 1425198


Ignore:
Timestamp:
05/27/2016 03:52:00 AM (10 years ago)
Author:
allnull
Message:

fix security issues;

File:
1 edited

Legend:

Unmodified
Added
Removed

  • wp-code-prettify/trunk/wp-code-prettify-page.php

    r1312280 r1425198  
    66$wpcp_status = "normal";
    77
    8 if(isset($_POST['wpcp_update_options'])) {
    9     if($_POST['wpcp_update_options'] == 'Y') {
    10         update_option("wp_code_prettify", maybe_serialize($_POST));
    11         $wpcp_status = 'update_success';
    12     }
     8if ( ! empty( $_POST )
     9    && check_admin_referer('wpcp_nonce_action', 'wpcp_nonce_field')
     10    && current_user_can('update_plugins')
     11    && isset($_POST['wpcp_update_options'])
     12    && $_POST['wpcp_update_options'] == 'Y') {
     13
     14    update_option("wp_code_prettify", maybe_serialize($_POST));
     15    $wpcp_status = 'update_success';
    1316}
    1417
    … …  
    8891    <form method="post" action="<?php echo get_bloginfo("wpurl"); ?>/wp-admin/options-general.php?page=wp-code-prettify">
    8992    <input type="hidden" name="wpcp_update_options" value="Y">
     93    <?php wp_nonce_field('wpcp_nonce_action', 'wpcp_nonce_field'); ?>
    9094
    9195    <script type="text/javascript">
Note: See TracChangeset for help on using the changeset viewer.