Improvement to check_admin_referer() when called without first argume…

…nt (PLUGIN AUTHORS: STOP DOING THAT). props indie-ulf. fixes #16449 for 3.0 git-svn-id: http://svn.automattic.com/wordpress/branches/3.0@17387 1a063a9b-81f0-0310-95a4-ce76da25c4cd
justintadlock · Feb 3, 2011 · 6d38b68 · 6d38b68
1 parent 6f42240
commit 6d38b68
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
@@ -825,7 +825,7 @@ function check_admin_referer($action = -1, $query_arg = '_wpnonce') {
 	$adminurl = strtolower(admin_url());
 	$referer = strtolower(wp_get_referer());
 	$result = isset($_REQUEST[$query_arg]) ? wp_verify_nonce($_REQUEST[$query_arg], $action) : false;
-	if ( !$result && !(-1 == $action && strpos($referer, $adminurl) !== false) ) {
+	if ( !$result && !(-1 == $action && strpos($referer, $adminurl) === 0) ) {
 		wp_nonce_ays($action);
 		die();
 	}