Changeset 2841860

Timestamp:

12/31/2022 05:29:47 PM (3 years ago)

Author:

topdownjimmy

Message:

• Use wp_verify_nonce to protect against CSRF
• Use sprintf for translations.

Location:

edit-custom-fields/trunk

Files:

• edit-custom-fields.php (modified) (4 diffs)
• readme.txt (modified) (2 diffs)

edit-custom-fields/trunk/edit-custom-fields.php

@@ -4 +4 @@
 Plugin URI:
 Description: A simple interface to edit or delete Custom Fields.
-Version: 0.1.7
+Version: 0.1.8
 Author: Jay Sitter
 Author URI: http://www.jaysitter.com/
@@ -28 +28 @@
 
         if ( isset( $_POST['delete'] ) ) { // If the user has confirmed a delete action
+      $nonce = $_REQUEST['_wpnonce'];
 
             if ( $_POST['delete'] == 'confirm' ) {
 
-                if ( !check_admin_referer('ecf_delete' ) ) {
+                if ( !wp_verify_nonce( $nonce, 'ecf_delete') ) {
                     die( __( 'Nonce doesn’t match', 'ecf' ) );
                 }
@@ -46 +47 @@
 
             if ( $_POST['rename'] == 'confirm' || $_POST['rename'] == 'undo' ) {
-
-                if ( !check_admin_referer('ecf_rename' ) ) {
+        $nonce = $_REQUEST['_wpnonce'];
+
+                if ( !wp_verify_nonce( $nonce, 'ecf_rename') ) {
                     die( __( 'Nonce doesn’t match', 'ecf' ) );
                 }
@@ -62 +64 @@
                     $existing = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $wpdb->postmeta WHERE meta_key = '%s'", $value ) );
                     if ( count( $existing ) > 0 ) {
-                        echo '<p style="color:red;">', __( 'The Custom Field', 'ecf' ), ' "', $key, '" ', __( 'could not be renamed to', 'ecf' ), ' "', $value, '" ', __( 'because a Custom Field with that key already exists.', 'ecf' ), '</p>';
+                        echo '<p style="color:red;">', sprintf( __( 'The Custom Field "%s" could not be renamed to "%s" because a Custom Field with that key already exists.', 'ecf' ), $key, $value ), '</p>';
                     } else {
                         $wpdb->update( $wpdb->postmeta, array( 'meta_key' => $value ), array( 'meta_key' => $key ) );
-                        echo '<p>', __( 'The Custom Field', 'ecf' ), ' "', $key, '" ', __( 'was renamed to', 'ecf' ), ' "', $value, '" . </p>';
+                        echo '<p>', sprintf( __( 'The Custom Field "%s" was renamed to "%s".', 'ecf'), $key, $value ), '</p>';
                         $success = true;
                     }

edit-custom-fields/trunk/readme.txt

@@ -3 +3 @@
 Tags: custom fields, customfields, custom field, customfield, admin
 Requires at least: 3.5.1
-Tested up to: 5.5.3
-Stable tag: 0.1.7
+Tested up to: 6.1.1
+Stable tag: 0.1.8
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -32 +32 @@
 
 == Changelog ==
+
+= 0.1.8 =
+
+- Use wp_verify_nonce to protect against CSRF
+- Use sprintf for translations.
 
 = 0.1.7 =