From 825faf32da48ef7d428fea726567efe5b3e3fba2 Mon Sep 17 00:00:00 2001 From: Scott Taylor Date: Sat, 21 Sep 2013 16:25:57 +0000 Subject: [PATCH] Use `elseif` when slurping the `nonce` in `check_ajax_referer()` to avoid accidentally overwriting it. Fail wonderboymusic in [25433]. Props ocean90. Fixes #25369. See [25433]. git-svn-id: https://develop.svn.wordpress.org/trunk@25550 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/pluggable.php | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index 1fa7f68aad..a5dfd53496 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -832,13 +832,11 @@ if ( !function_exists('check_ajax_referer') ) : function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) { $nonce = ''; - if ( $query_arg && isset( $_REQUEST[$query_arg] ) ) - $nonce = $_REQUEST[$query_arg]; - - if ( isset( $_REQUEST['_ajax_nonce'] ) ) + if ( $query_arg && isset( $_REQUEST[ $query_arg ] ) ) + $nonce = $_REQUEST[ $query_arg ]; + elseif ( isset( $_REQUEST['_ajax_nonce'] ) ) $nonce = $_REQUEST['_ajax_nonce']; - - if ( isset( $_REQUEST['_wpnonce'] ) ) + elseif ( isset( $_REQUEST['_wpnonce'] ) ) $nonce = $_REQUEST['_wpnonce']; $result = wp_verify_nonce( $nonce, $action );