10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-11 18:56:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1287 from ultimatemember/fix/add-nonce-verification-install-info

Browse Source 
Add nonce validation for download install info
This commit is contained in:
Mykyta Synelnikov
2023-09-04 22:21:23 +03:00
committed by GitHub
parent b2d12d49b9 7e4543f0d3
commit 645ae33089
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/admin/core/class-admin-settings.php
+7
View File
@@ -3689,6 +3689,7 @@ Use Only Cookies: <?php echo ini_get( 'session.use_only_cookies' ) ?
<p class="submit">
<input type="hidden" name="um-addon-hook" value="download_install_info" />
<?php submit_button( 'Download Install Info File', 'primary', 'download_install_info', false ); ?>
<?php wp_nonce_field( 'um_download_install_info' ); ?>
</p>
</form>
@@ -3700,7 +3701,13 @@ Use Only Cookies: <?php echo ini_get( 'session.use_only_cookies' ) ?
*
*/
function um_download_install_info() {
if ( ! empty( $_POST['download_install_info'] ) ) {
$nonce = $_REQUEST['_wpnonce'];
if ( ! wp_verify_nonce( $nonce, 'um_download_install_info' ) || ! current_user_can( 'manage_options' ) ) {
die( __( 'Security check', 'ultimate-member' ) );
}
nocache_headers();
header( "Content-type: text/plain" );