Changeset 1082625

Timestamp:

02/04/2015 10:13:27 PM (10 years ago)

Author:

moskis

Message:

fix security issue (thanks to mickaelb for reporting and Konstantin Kovshenin for providing the fix)

Location:

fancybox-for-wordpress/trunk

Files:

• admin.php (modified) (1 diff)
• fancybox.php (modified) (1 diff)

fancybox-for-wordpress/trunk/admin.php

@@ -82 +82 @@
     <form method="post" action="">
         <div style="text-align:center;padding:0 0 1.5em;margin:-15px 0 5px;">
+            <?php wp_nonce_field( 'mfbfw-options-reset' ); ?>
             <input type="submit" name="mfbfw_update" id="reset" onClick="return confirmDefaults();" class="button-secondary" value="<?php esc_attr_e( 'Revert to defaults', 'mfbfw' ); ?>" />
             <input type="hidden" name="action" value="reset" />

fancybox-for-wordpress/trunk/fancybox.php

@@ -342 +342 @@
     if ( isset($_GET['page']) && $_GET['page'] == 'fancybox-for-wordpress' ) {
 
-        if ( isset($_REQUEST['action']) && 'update' == $_REQUEST['action'] ) {
-
-            $settings = stripslashes_deep( $_POST['mfbfw'] );
-            $settings = array_map( 'convert_chars', $settings );
-
-            update_option( 'mfbfw', $settings );
-            wp_safe_redirect( add_query_arg('updated', 'true') );
-            die;
-
-        } else if ( isset($_REQUEST['action']) && 'reset' == $_REQUEST['action'] ) {
+        if ( isset($_REQUEST['action']) && 'reset' == $_REQUEST['action'] && check_admin_referer( 'mfbfw-options-options' ) ) {
 
             $defaults_array = mfbfw_defaults(); // Store defaults in an array