Changeset 784566

Timestamp:

10/08/2013 02:29:47 PM (11 years ago)

Author:

dllh

Message:

Adding a nonce to prevent CSRF.

Location:

blogger-importer/trunk

Files:

• blogger-importer.php (modified) (3 diffs)
• readme.txt (modified) (2 diffs)

blogger-importer/trunk/blogger-importer.php

@@ -6 +6 @@
 Author: wordpressdotorg
 Author URI: http://wordpress.org/
-Version: 0.6
+Version: 0.
 License: GPLv2
 License URI: http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
@@ -930 +930 @@
             $options = get_option('blogger_importer');
 
-            delete_option('blogger_importer');
-            $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
+            if ( check_admin_referer( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ) ) {
+                delete_option('blogger_importer');
+                $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
+            }
             wp_redirect('?import=blogger');
+
         }
 
@@ -984 +987 @@
                     'blogger-importer');
                 $submit = esc_attr__('Clear account information', 'blogger-importer');
-                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'><p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
+                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'>";
+                wp_nonce_field( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ); 
+                echo "<p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
             }
         }

blogger-importer/trunk/readme.txt

@@ -4 +4 @@
 Tags: importer, blogger
 Requires at least: 3.0
-Tested up to: 3.4
-Stable tag: 0.5
+Tested up to: 3.
+Stable tag: 0.
 License: GPLv2 or later
 
@@ -96 +96 @@
 == Changelog ==
 
+
+
+
 = 0.5 =
 * Merged in fix by SergeyBiryukov http://core.trac.wordpress.org/ticket/16012