From cf9b82dd14ddbdab3017b5331bd459dd1d343a9f Mon Sep 17 00:00:00 2001 From: Helen Hou-Sandi Date: Wed, 1 Jul 2015 03:36:58 +0000 Subject: [PATCH] Fire the `check_admin_referer` action on failure as well as success. This enables things like logging nonce failures in the admin. props markjaquith. fixes #32207. git-svn-id: https://develop.svn.wordpress.org/trunk@33017 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/pluggable.php | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php index f0934588bd..1295282790 100644 --- a/src/wp-includes/pluggable.php +++ b/src/wp-includes/pluggable.php @@ -1091,10 +1091,6 @@ function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) { $adminurl = strtolower(admin_url()); $referer = strtolower(wp_get_referer()); $result = isset($_REQUEST[$query_arg]) ? wp_verify_nonce($_REQUEST[$query_arg], $action) : false; - if ( !$result && !(-1 == $action && strpos($referer, $adminurl) === 0) ) { - wp_nonce_ays($action); - die(); - } /** * Fires once the admin request has been validated or not. @@ -1106,6 +1102,12 @@ function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) { * 0-12 hours ago, 2 if the nonce is valid and generated between 12-24 hours ago. */ do_action( 'check_admin_referer', $action, $result ); + + if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) { + wp_nonce_ays( $action ); + die(); + } + return $result; } endif;