Changeset 4023

Timestamp:

06/28/2012 04:13:43 PM (14 years ago)

Author:

johnjamesjacoby

Message:

Nonces:

• Introduce bbp_verify_nonce_request() to check nonces on theme-side requests.
• See #1863.

File:

• branches/plugin/bbp-includes/bbp-common-functions.php (modified) (1 diff)

branches/plugin/bbp-includes/bbp-common-functions.php

@@ -1394 +1394 @@
 }
 
+/** Nonces ********************************************************************/
+
+/**
+ * Makes sure the user requested an action from another page on this site.
+ *
+ * To avoid security exploits within the theme.
+ *
+ * @since bbPress (r4022)
+ *
+ * @uses do_action() Calls 'bbp_check_referer' on $action.
+ * @param string $action Action nonce
+ * @param string $query_arg where to look for nonce in $_REQUEST
+ */
+function bbp_verify_nonce_request( $action = '', $query_arg = '_wpnonce' ) {
+
+    // Get the home URL
+    $home_url = strtolower( home_url() );
+
+    // Build the currently requested URL
+    $scheme        = is_ssl() ? 'https://' : 'http://';
+    $requested_url = strtolower( $scheme . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
+
+    // Check the nonce
+    $result = isset( $_REQUEST[$query_arg] ) ? wp_verify_nonce( $_REQUEST[$query_arg], $action ) : false;
+
+    // Nonce check failed
+    if ( empty( $result ) || empty( $action ) || ( strpos( $requested_url, $home_url ) !== 0 ) )
+        $result = false;
+
+    // Do extra things
+    do_action( 'bbp_verify_nonce_request', $action, $result );
+
+    return $result;
+}
+
 /** Feeds *********************************************************************/