Changeset 1032 for trunk/bp-blogs/bp-blogs-templatetags.php

Timestamp:

02/09/2009 06:52:51 AM (17 years ago)

Author:

apeatling

Message:

Added nonce security checks to all BuddyPress actions. Fixes #454

File:

• trunk/bp-blogs/bp-blogs-templatetags.php (modified) (2 diffs)

trunk/bp-blogs/bp-blogs-templatetags.php

@@ -692 +692 @@
                 <input id="submit" type="submit" name="submit" class="submit" value="<?php _e('Create Blog &raquo;', 'buddypress') ?>" />
             </p>
+            
+            <?php wp_nonce_field( 'bp_blog_signup_form' ) ?>
         </form>
         <?php
@@ -755 +757 @@
     global $wpdb, $current_user, $blogname, $blog_title, $errors, $domain, $path;
 
+    if ( !check_admin_referer( 'bp_blog_signup_form' ) ) 
+        return false;
+
     $current_user = wp_get_current_user();