From f7b9a96f347cf373aecab9b64c53b67aa08514fd Mon Sep 17 00:00:00 2001 From: Ryan Boren Date: Thu, 23 Dec 2010 16:20:36 +0000 Subject: [PATCH] nonce checks for ms themes. see #15969 git-svn-id: https://develop.svn.wordpress.org/trunk@17122 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-admin/network/themes.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/wp-admin/network/themes.php b/wp-admin/network/themes.php index 4105647017..c70e977f84 100644 --- a/wp-admin/network/themes.php +++ b/wp-admin/network/themes.php @@ -34,18 +34,21 @@ if ( $action ) { $allowed_themes = get_site_option( 'allowedthemes' ); switch ( $action ) { case 'enable': + check_admin_referer('enable-theme_' . $_GET['theme']); $allowed_themes[ $_GET['theme'] ] = true; update_site_option( 'allowedthemes', $allowed_themes ); wp_redirect( wp_get_referer() ); // @todo add_query_arg for update message exit; break; case 'disable': + check_admin_referer('disable-theme_' . $_GET['theme']); unset( $allowed_themes[ $_GET['theme'] ] ); update_site_option( 'allowedthemes', $allowed_themes ); wp_redirect( wp_get_referer() ); // @todo add_query_arg for update message exit; break; case 'enable-selected': + check_admin_referer('bulk-themes'); $themes = isset( $_POST['checked'] ) ? (array) $_POST['checked'] : array(); if ( empty($themes) ) { wp_redirect( wp_get_referer() ); @@ -56,6 +59,7 @@ if ( $action ) { update_site_option( 'allowedthemes', $allowed_themes ); break; case 'disable-selected': + check_admin_referer('bulk-themes'); $themes = isset( $_POST['checked'] ) ? (array) $_POST['checked'] : array(); if ( empty($themes) ) { wp_redirect( wp_get_referer() );