Changeset 5809 for trunk/src/includes/admin/admin.php

Timestamp:

07/07/2015 03:48:38 PM (11 years ago)

Author:

johnjamesjacoby

Message:

Admin: Remove _nopriv_ ajax actions.

This commit ensures that admin-area AJAX suggestion results are never presented to logged-out users.

(Note: these requests already have nonce & capability checks on them, so this bit of hardening is only useful to installations that have modified roles & capabilities outside of what is considered to be normal operating parameters, allowing logged-out users to also be forum moderators.)

Hat-tip glynwintle. See #2827. For 2.6.0 (trunk)

File:

• trunk/src/includes/admin/admin.php (modified) (1 diff)

trunk/src/includes/admin/admin.php

@@ -150 +150 @@
         /** Ajax **************************************************************/
 
-        add_action( 'wp_ajax_bbp_suggest_topic',        array( $this, 'suggest_topic' ) );
-        add_action( 'wp_ajax_nopriv_bbp_suggest_topic', array( $this, 'suggest_topic' ) );
-
-        add_action( 'wp_ajax_bbp_suggest_user',         array( $this, 'suggest_user'  ) );
-        add_action( 'wp_ajax_nopriv_bbp_suggest_user',  array( $this, 'suggest_user'  ) );
+        // No _nopriv_ equivalent - users must be logged in
+        add_action( 'wp_ajax_bbp_suggest_topic', array( $this, 'suggest_topic' ) );
+        add_action( 'wp_ajax_bbp_suggest_user',  array( $this, 'suggest_user'  ) );
 
         /** Filters ***********************************************************/