From 74226b61d412e501bf334d9db681fd03ee72928a Mon Sep 17 00:00:00 2001
From: Ryan Boren <ryan@git.wordpress.org>
Date: Fri, 30 May 2008 20:43:36 +0000
Subject: [PATCH] Add some noncing. Props andy.

git-svn-id: https://develop.svn.wordpress.org/trunk@8023 602fd350-edb4-49c9-b593-d223f7449a82
---
 wp-admin/async-upload.php   | 2 ++
 wp-admin/includes/media.php | 1 +
 2 files changed, 3 insertions(+)

diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php
index 6f5c153cd0..59feb8cec2 100644
--- a/wp-admin/async-upload.php
+++ b/wp-admin/async-upload.php
@@ -26,6 +26,8 @@ if ( ($id = intval($_REQUEST['attachment_id'])) && $_REQUEST['fetch'] ) {
 	exit;
 }
 
+check_admin_referer('media-form');
+
 $id = media_handle_upload('async-upload', $_REQUEST['post_id']);
 if (is_wp_error($id)) {
 	echo '<div id="media-upload-error">'.wp_specialchars($id->get_error_message()).'</div>';
diff --git a/wp-admin/includes/media.php b/wp-admin/includes/media.php
index 0e34137969..c40110cd56 100644
--- a/wp-admin/includes/media.php
+++ b/wp-admin/includes/media.php
@@ -790,6 +790,7 @@ jQuery(function($){
 			post_params : {
 				"post_id" : "<?php echo $post_id; ?>",
 				"auth_cookie" : "<?php echo $_COOKIE[AUTH_COOKIE]; ?>",
+				"_wpnonce" : "<?php echo wp_create_nonce('media-form'); ?>",
 				"type" : "<?php echo $type; ?>",
 				"tab" : "<?php echo $tab; ?>",
 				"short" : "1"