Make the screenshot delete action require a per-image specific nonce …

…value to avoid passing a generic non-screenshot post ID. See #465
WordPress · Jul 25, 2024 · ac8d8e1 · ac8d8e1
1 parent 89ccf6e
commit ac8d8e1
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/HealthCheck/class-health-check-screenshots.php b/HealthCheck/class-health-check-screenshots.php
@@ -60,7 +60,10 @@ public function delete_screenshot() {
 		}
 
 		// Validate nonces.
-		if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( $_GET['_wpnonce'], 'health-check-delete-screenshot' ) ) {
+		if ( ! isset( $_GET['_wpnonce'] ) ) {
+			return;
+		}
+		if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'health-check-delete-screenshot-' . absint( $_GET['health-check-delete-screenshot'] ) ) ) {
 			return;
 		}
 

diff --git a/pages/screenshots.php b/pages/screenshots.php
@@ -91,7 +91,10 @@
 								),
 								admin_url( 'site-health.php' )
 							),
-							'health-check-delete-screenshot'
+							sprintf(
+								'health-check-delete-screenshot-%d',
+								$screenshot->ID
+							)
 						)
 					),
 					esc_html__( 'Delete screenshot', 'health-check' )