Add nonce verification and sanitize $_REQUEST/$_GET values.

Signed-off-by: Colin Stewart <[email protected]>
aspirepress · Nov 4, 2024 · a960cdd · a960cdd
1 parent 1b30e71
commit a960cdd
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/includes/class-themes-screens.php b/includes/class-themes-screens.php
@@ -90,7 +90,12 @@ public function admin_enqueue_scripts( $hook ) {
 	 * @return void
 	 */
 	public function redirect_to_theme_install() {
-		$browse = isset( $_GET['browse'] ) ? wp_unslash( $_GET['browse'] ) : '';
+		$nonce = isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : false;
+		if ( $nonce && ! wp_verify_nonce( $nonce, 'query-themes' ) ) {
+			return;
+		}
+
+		$browse = isset( $_GET['browse'] ) ? sanitize_text_field( wp_unslash( $_GET['browse'] ) ) : '';
 		if ( ! in_array( $browse, $this->unsupported_filters, true ) ) {
 			return;
 		}