Changeset 12624

Timestamp:

04/21/2020 06:02:58 PM (5 years ago)

Author:

boonebgorges

Message:

Add nonces to xProfile field deletion links.

File:

• trunk/src/bp-xprofile/bp-xprofile-admin.php (modified) (2 diffs)

trunk/src/bp-xprofile/bp-xprofile-admin.php

@@ -565 +565 @@
     global $message, $type;
 
+    check_admin_referer( 'bp_xprofile_delete_field-' . $field_id, 'bp_xprofile_delete_field' );
+
     // Switch type to 'option' if type is not 'field'.
     // @todo trust this param.
@@ -728 +730 @@
 
                     <div class="delete-button">
-                        <a class="confirm submit-delete deletion" href="<?php echo esc_url( $field_delete_url ); ?>"><?php _ex( 'Delete', 'Delete field link', 'buddypress' ); ?></a>
+                        <a class="confirm submit-delete deletion" href="<?php echo esc_url( wp_nonce_url( $field_delete_url, 'bp_xprofile_delete_field-' . $field->id, 'bp_xprofile_delete_field' ) ); ?>"><?php _ex( 'Delete', 'Delete field link', 'buddypress' ); ?></a>
                     </div>