Themes: Ensure that only privileged users can set a background image when a theme is using the deprecated custom background page.
Props xknown, zieladam, peterwilsoncc, whyisjake git-svn-id: https://develop.svn.wordpress.org/branches/5.5@49379 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
parent
9ece9cf045
commit
69e8323982
@ -126,11 +126,13 @@
|
||||
frame.on( 'select', function() {
|
||||
// Grab the selected attachment.
|
||||
var attachment = frame.state().get('selection').first();
|
||||
var nonceValue = $( '#_wpnonce' ).val() || '';
|
||||
|
||||
// Run an Ajax request to set the background image.
|
||||
$.post( ajaxurl, {
|
||||
action: 'set-background-image',
|
||||
attachment_id: attachment.id,
|
||||
_ajax_nonce: nonceValue,
|
||||
size: 'full'
|
||||
}).done( function() {
|
||||
// When the request completes, reload the window.
|
||||
|
@ -11,7 +11,7 @@ jQuery(function($) {
|
||||
* Adds a click event handler to the element with a 'wp-gallery' class.
|
||||
*/
|
||||
$( 'body' ).bind( 'click.wp-gallery', function(e) {
|
||||
var target = $( e.target ), id, img_size;
|
||||
var target = $( e.target ), id, img_size, nonceValue;
|
||||
|
||||
if ( target.hasClass( 'wp-set-header' ) ) {
|
||||
// Opens the image to preview it full size.
|
||||
@ -21,6 +21,7 @@ jQuery(function($) {
|
||||
// Sets the image as background of the theme.
|
||||
id = target.data( 'attachment-id' );
|
||||
img_size = $( 'input[name="attachments[' + id + '][image-size]"]:checked').val();
|
||||
nonceValue = $( '#_wpnonce' ).val() && '';
|
||||
|
||||
/**
|
||||
* This Ajax action has been deprecated since 3.5.0, see custom-background.php
|
||||
@ -28,6 +29,7 @@ jQuery(function($) {
|
||||
jQuery.post(ajaxurl, {
|
||||
action: 'set-background-image',
|
||||
attachment_id: id,
|
||||
_ajax_nonce: nonceValue,
|
||||
size: img_size
|
||||
}, function() {
|
||||
var win = window.dialogArguments || opener || parent || top;
|
||||
|
@ -581,6 +581,8 @@ class Custom_Background {
|
||||
* @deprecated 3.5.0
|
||||
*/
|
||||
public function wp_set_background_image() {
|
||||
check_ajax_referer( 'custom-background' );
|
||||
|
||||
if ( ! current_user_can( 'edit_theme_options' ) || ! isset( $_POST['attachment_id'] ) ) {
|
||||
exit;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user