WordPress.org
Get WordPress

Plugin Directory

Changeset 2915488


Ignore:
Timestamp:
05/21/2023 07:00:56 PM (3 years ago)
Author:
stephend
Message:

Check for nonce when updating settings

File:
1 edited

Legend:

Unmodified
Added
Removed

  • smart-app-banner/trunk/wsl-smart-app-banner.php

    r2625738 r2915488  
    140140    // If they did, this hidden field will be set to 'Y'
    141141    if( isset($_POST[ $hidden_field_name ]) && $_POST[ $hidden_field_name ] == 'Y' ) {
    142    
     142
     143      if (!isset($_POST['wsl-update']) || !wp_verify_nonce($_POST['wsl-update'],'wsl-update')) {
     144        die("<br><br>Invalid update");   
     145      }
     146
    143147      if (isset($_POST['add'])) {
    144148        // add new app
    … …  
    223227<form name="form1" method="post" action="">
    224228<input type="hidden" name="<?php echo $hidden_field_name; ?>" value="Y">
     229<?php wp_nonce_field('update_settings', 'wsl-update'); ?>
    225230
    226231<h3><?php _e('Homepage', 'smart-app-banner'); ?></h3>
Note: See TracChangeset for help on using the changeset viewer.