From 7094c53fe1f092373c34309512bde146bee57571 Mon Sep 17 00:00:00 2001 From: Chris Mospaw Date: Tue, 4 Nov 2014 13:07:35 -0700 Subject: [PATCH] add Social::wp39_nonce_url() function, and replace wp_nonce_url with it. --- social-twitter.php | 2 +- social.php | 23 +++++++++++++++++++---- views/wp-admin/options.php | 2 +- views/wp-admin/post/meta/log/shell.php | 4 ++-- 4 files changed, 23 insertions(+), 8 deletions(-) diff --git a/social-twitter.php b/social-twitter.php index f9487a1f..e7da5782 100755 --- a/social-twitter.php +++ b/social-twitter.php @@ -87,7 +87,7 @@ public static function comments_array(array $comments, $post_id) { $broadcasted_social_ids[] = $id; // if we don't have a message saved for a tweet, try to get it so that we can use it next time if (empty($data['message'])) { - $url = wp_nonce_url(home_url('index.php?social_controller=aggregation&social_action=retrieve_twitter_content&broadcasted_id='.$id.'&post_id='.$post_id), 'retrieve_twitter_content'); + $url = Social::wp39_nonce_url(home_url('index.php?social_controller=aggregation&social_action=retrieve_twitter_content&broadcasted_id='.$id.'&post_id='.$post_id), 'retrieve_twitter_content'); wp_remote_get(str_replace('&', '&', $url), array( 'timeout' => 0.01, 'blocking' => false, diff --git a/social.php b/social.php index f71cf445..faecb7ed 100755 --- a/social.php +++ b/social.php @@ -1722,7 +1722,7 @@ public function post_row_actions(array $actions, $post) { && $post->post_status == 'publish' && Social::option('aggregate_comments')) { - $actions['social_aggregation'] = sprintf(__('Social Comments', 'social'), esc_url(wp_nonce_url(admin_url('options-general.php?social_controller=aggregation&social_action=run&post_id='.$post->ID), 'run')), $post->ID). + $actions['social_aggregation'] = sprintf(__('Social Comments', 'social'), esc_url(Social::wp39_nonce_url(admin_url('options-general.php?social_controller=aggregation&social_action=run&post_id='.$post->ID), 'run')), $post->ID). ''; } return $actions; @@ -1758,13 +1758,13 @@ public function admin_bar_menu() { . . )', - 'href' => esc_url(wp_nonce_url(admin_url('options-general.php?social_controller=aggregation&social_action=run&post_id='.$current_object->ID), 'run')), + 'href' => esc_url(Social::wp39_nonce_url(admin_url('options-general.php?social_controller=aggregation&social_action=run&post_id='.$current_object->ID), 'run')), )); $wp_admin_bar->add_menu(array( 'parent' => 'comments', 'id' => 'social-add-tweet-by-url', 'title' => __('Add Tweet by URL', 'social') - .'', @@ -1968,7 +1968,7 @@ public function kses($object) { */ private function request($url, $nonce_key = null, $post = false) { if ($nonce_key !== null) { - $url = str_replace('&', '&', wp_nonce_url($url, $nonce_key)); + $url = str_replace('&', '&', Social::wp39_nonce_url($url, $nonce_key)); } @@ -2256,6 +2256,21 @@ public static function wp39_create_nonce($action = -1) { } + /** + * Retrieve URL with nonce added to URL query using Social::wp39_create_nonce() + * instead of Social::wp_create_nonce() + * + * @param string $actionurl URL to add nonce action. + * @param string $action Optional. Nonce action name. Default -1. + * @param string $name Optional. Nonce name. Default '_wpnonce'. + * @return string Escaped URL with nonce action added. + */ + public static function wp39_nonce_url( $actionurl, $action = -1, $name = '_wpnonce' ) { + $actionurl = str_replace( '&', '&', $actionurl ); + return esc_html( add_query_arg( $name, Social::wp39_create_nonce( $action ), $actionurl ) ); + } + + } // End Social if (!function_exists('addslashes_deep')) { diff --git a/views/wp-admin/options.php b/views/wp-admin/options.php index 68d1eea8..6e248ae8 100755 --- a/views/wp-admin/options.php +++ b/views/wp-admin/options.php @@ -187,7 +187,7 @@