Skip to content

Commit 35bf57a

Browse files
committed
Wp-nonce to protect against csrf requests in the search form
1 parent 822dfd4 commit 35bf57a

File tree

2 files changed

+14
-1
lines changed

2 files changed

+14
-1
lines changed

search.php

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,16 @@
44
*
55
* @package multiloquent\template_parts
66
*/
7-
get_template_part('archive');
7+
8+
if (empty( $_POST['name_of_nonce_field']) || ! wp_verify_nonce( $_POST['search'], 'search' ) ) {
9+
// 404 ?
10+
get_header();
11+
echo '<div class="container post"> ';
12+
get_template_part('error-snippet');
13+
echo '</div>';
14+
get_footer();
15+
exit;
16+
} else {
17+
// process form data
18+
get_template_part('archive');
19+
}

searchform.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,6 @@
1414
<span class="input-group-addon">
1515
<label title="search" for="s" class="" style="margin:0"><span class="fa fa-search fafw"></span></label>
1616
</span>
17+
<?php wp_nonce_field('search','search'); ?>
1718
</div>
1819
</form>

0 commit comments

Comments
 (0)