Changeset 1315212

Timestamp:

12/23/2015 05:53:54 PM (10 years ago)

Author:

froman118

Message:

Added nonce for CSRF protection and compliance

File:

• my-page-order/trunk/mypageorder.php (modified) (4 diffs)

my-page-order/trunk/mypageorder.php

@@ -4 +4 @@
 Plugin URI: http://www.geekyweekly.com/mypageorder
 Description: My Page Order allows you to set the order of pages through a drag and drop interface. The default method of setting the order page by page is extremely clumsy, especially with a large number of pages.
-Version: 4.3
+Version: 4.3.2
 Author: Andrew Charlton
 Author URI: http://www.geekyweekly.com
@@ -44 +44 @@
 global $wpdb;
 $parentID = 0;
-
-if (isset($_POST['btnSubPages'])) { 
+$success = "";
+
+if (isset($_POST)) {
+    if ( ! isset( $_POST['_nonce_my_page_order'] ) || ! wp_verify_nonce( $_POST['_nonce_my_page_order'], 'update' )  ) {
+     // exit;
+    }
+    
+    if (isset($_POST['btnSubPages'])) { 
     $parentID = $_POST['pages'];
-}
-elseif (isset($_POST['hdnParentID'])) { 
-    $parentID = $_POST['hdnParentID'];
-}
-
-if (isset($_POST['btnReturnParent'])) { 
-    $parentsParent = $wpdb->get_row( $wpdb->prepare("SELECT post_parent FROM $wpdb->posts WHERE ID = %d ", $_POST['hdnParentID'] ), ARRAY_N);
-    $parentID = $parentsParent[0];
-}
-
-$success = "";
-if (isset($_POST['btnOrderPages'])) { 
-    $success = mypageorder_updateOrder();
+    }
+    elseif (isset($_POST['hdnParentID'])) { 
+        $parentID = $_POST['hdnParentID'];
+    }
+
+    if (isset($_POST['btnReturnParent'])) { 
+        $parentsParent = $wpdb->get_row( $wpdb->prepare("SELECT post_parent FROM $wpdb->posts WHERE ID = %d ", $_POST['hdnParentID'] ), ARRAY_N);
+        $parentID = $parentsParent[0];
+    }
+
+    if (isset($_POST['btnOrderPages'])) { 
+        $success = mypageorder_updateOrder();
+    }
 }
 
@@ -104 +110 @@
     <input type="hidden" id="hdnMyPageOrder" name="hdnMyPageOrder" />
     <input type="hidden" id="hdnParentID" name="hdnParentID" value="<?php echo $parentID; ?>" />
+    <?php wp_nonce_field('update', '_nonce_my_page_order' ); ?>
 </form>
 </div>
@@ -444 +451 @@
             <small><?php _e( 'Number of pages to skip.', 'mypageorder' ); ?></small>
         </p>
-        
 <?php
     }
-
 }