Skip to:
Content

BuddyPress.org


Ignore:
Timestamp:
08/23/2017 09:42:52 AM (4 years ago)
Author:
djpaul
Message:

xprofile: add nonce to "delete group" link in wp-admin screen.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/bp-xprofile/bp-xprofile-admin.php

    r11519 r11675  
    197197
    198198                                    <div class="delete-button">
    199                                         <a class="confirm submitdelete deletion ajax-option-delete" href="users.php?page=bp-profile-setup&amp;mode=delete_group&amp;group_id=<?php echo esc_attr( $group->id ); ?>"><?php _ex( 'Delete Group', 'Delete Profile Fields Group', 'buddypress' ); ?></a>
     199                                        <a class="confirm submitdelete deletion ajax-option-delete" href="<?php echo esc_url( wp_nonce_url( 'users.php?page=bp-profile-setup&amp;mode=delete_group&amp;group_id=' . intval( $group->id ), 'bp_xprofile_delete_group' ) ); ?>"><?php _ex( 'Delete Group', 'Delete Profile Fields Group', 'buddypress' ); ?></a>
    200200                                    </div>
    201201
     
    361361    global $message, $type;
    362362
     363    check_admin_referer( 'bp_xprofile_delete_group' );
     364
    363365    $group = new BP_XProfile_Group( $group_id );
    364366
Note: See TracChangeset for help on using the changeset viewer.