Changeset 11675 for trunk/src/bp-xprofile/bp-xprofile-admin.php

Timestamp:

08/23/2017 09:42:52 AM (6 years ago)

Author:

djpaul

Message:

xprofile: add nonce to "delete group" link in wp-admin screen.

File:

• trunk/src/bp-xprofile/bp-xprofile-admin.php (modified) (2 diffs)

trunk/src/bp-xprofile/bp-xprofile-admin.php

@@ -197 +197 @@
 
                                     <div class="delete-button">
-                                        <a class="confirm submitdelete deletion ajax-option-delete" href="users.php?page=bp-profile-setup&amp;mode=delete_group&amp;group_id=<?php echo esc_attr( $group->id ); ?>"><?php _ex( 'Delete Group', 'Delete Profile Fields Group', 'buddypress' ); ?></a>
+                                        <a class="confirm submitdelete deletion ajax-option-delete" href="<?php echo esc_url( wp_nonce_url( 'users.php?page=bp-profile-setup&amp;mode=delete_group&amp;group_id=' . intval( $group->id ), 'bp_xprofile_delete_group' ) ); ?>"><?php _ex( 'Delete Group', 'Delete Profile Fields Group', 'buddypress' ); ?></a>
                                     </div>
 
@@ -361 +361 @@
     global $message, $type;
 
+    check_admin_referer( 'bp_xprofile_delete_group' );
+
     $group = new BP_XProfile_Group( $group_id );