Changeset 11463 for branches/2.5/src/bp-settings/bp-settings-actions.php

Timestamp:

03/08/2017 07:55:07 PM (10 years ago)

Author:

boonebgorges

Message:

Improved nonce protection for some front-end AJAX endpoints.

Merge of [11459] to the 2.5 branch.

Location:

branches/2.5

Files:

• . (modified) (1 prop)
• src/bp-settings/bp-settings-actions.php (modified) (1 diff)

branches/2.5/src/bp-settings/bp-settings-actions.php

@@ -473 +473 @@
         // Email change is being dismissed.
         } elseif ( ! empty( $_GET['dismiss_email_change'] ) ) {
-                bp_delete_user_meta( bp_displayed_user_id(), 'pending_email_change' );
-                bp_core_add_message( __( 'You have successfully dismissed your pending email change.', 'buddypress' ) );
+                $nonce_check = isset( $_GET['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_GET['_wpnonce'] ), 'bp_dismiss_email_change' );
+
+                if ( $nonce_check ) {
+                        bp_delete_user_meta( bp_displayed_user_id(), 'pending_email_change' );
+                        bp_core_add_message( __( 'You have successfully dismissed your pending email change.', 'buddypress' ) );
+                }
 
                 bp_core_redirect( $redirect_to );