Changeset 3221729

Timestamp:

01/13/2025 05:27:22 PM (13 months ago)

Author:

ctltwp

Message:

Add nonce check to improve ajax security

Location:

people-lists/trunk

Files:

• js/people-lists.js (modified) (2 diffs)
• people-lists.php (modified) (3 diffs)

people-lists/trunk/js/people-lists.js

@@ -9 +9 @@
     var data = {
         action : 'people_settings_save',
-        field_info : field_info
+        field_info : field_info,
+        nonce: people_lists_admin.nonce
     };
     
@@ -54 +55 @@
             list : groupList,
             form: people_list_form,
+            nonce: people_lists_admin.nonce
         };
         if($('#list-title').val() != '') 

people-lists/trunk/people-lists.php

@@ -143 +143 @@
  */
 function people_list_saving_settings() {
+    check_ajax_referer( 'people-lists', 'nonce' );
+
     if ( ! current_user_can( 'manage_options' ) ) {
         return;
@@ -175 +177 @@
  */
 function people_list_saving_list() {
+    check_ajax_referer( 'people-lists', 'nonce' );
+
     if ( ! current_user_can( 'manage_options' ) ) {
         return;
@@ -350 +354 @@
 function people_list_options_init_script() {
     wp_enqueue_script( 'people-lists', plugins_url( '/people-lists/js/people-lists.js' ), array( 'jquery', 'jquery-ui-tabs', 'jquery-ui-sortable' ) );
+
+    wp_localize_script(
+        'people-lists',
+        'people_lists_admin',
+        array(
+            'nonce' => wp_create_nonce( 'people-lists' ),
+        )
+    );
 }