From 7d88a90a226d5b3344e95c8c950fa13506fe12db Mon Sep 17 00:00:00 2001 From: ryan Date: Thu, 23 Dec 2010 16:20:36 +0000 Subject: [PATCH] nonce checks for ms themes. see #15969 git-svn-id: http://svn.automattic.com/wordpress/trunk@17122 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/network/themes.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/wp-admin/network/themes.php b/wp-admin/network/themes.php index 4105647017..c70e977f84 100644 --- a/wp-admin/network/themes.php +++ b/wp-admin/network/themes.php @@ -34,18 +34,21 @@ if ( $action ) { $allowed_themes = get_site_option( 'allowedthemes' ); switch ( $action ) { case 'enable': + check_admin_referer('enable-theme_' . $_GET['theme']); $allowed_themes[ $_GET['theme'] ] = true; update_site_option( 'allowedthemes', $allowed_themes ); wp_redirect( wp_get_referer() ); // @todo add_query_arg for update message exit; break; case 'disable': + check_admin_referer('disable-theme_' . $_GET['theme']); unset( $allowed_themes[ $_GET['theme'] ] ); update_site_option( 'allowedthemes', $allowed_themes ); wp_redirect( wp_get_referer() ); // @todo add_query_arg for update message exit; break; case 'enable-selected': + check_admin_referer('bulk-themes'); $themes = isset( $_POST['checked'] ) ? (array) $_POST['checked'] : array(); if ( empty($themes) ) { wp_redirect( wp_get_referer() ); @@ -56,6 +59,7 @@ if ( $action ) { update_site_option( 'allowedthemes', $allowed_themes ); break; case 'disable-selected': + check_admin_referer('bulk-themes'); $themes = isset( $_POST['checked'] ) ? (array) $_POST['checked'] : array(); if ( empty($themes) ) { wp_redirect( wp_get_referer() );