WordPress 4.6.2-scripts

[autoinstalls/wordpress.git] / wp-admin / widgets.php

diff --git a/wp-admin/widgets.php b/wp-admin/widgets.php
index a9876b891cef4d6dd6eb5a76440c8a1d9945c1e0..c70b1d1ad72ee86a099bda4cae986587ba045f48 100644 (file)
--- a/wp-admin/widgets.php
+++ b/wp-admin/widgets.php
@@ -22,6 +22,8 @@ if ( ! current_user_can( 'edit_theme_options' ) ) {
 
 $widgets_access = get_user_setting( 'widgets_access' );
 if ( isset($_GET['widgets-access']) ) {
+       check_admin_referer( 'widgets-access' );
+
        $widgets_access = 'on' == $_GET['widgets-access'] ? 'on' : 'off';
        set_user_setting( 'widgets_access', $widgets_access );
 }