Wordpress 2.0.11-scripts

[autoinstalls/wordpress.git] / wp-admin / plugin-editor.php

diff --git a/wp-admin/plugin-editor.php b/wp-admin/plugin-editor.php
index 37aed6b0c19abc2beaa5fd2f7e500cf942bc6fd2..0f9da3b91f2e61c93c9ab98712ef0f0c0615826f 100644 (file)
--- a/wp-admin/plugin-editor.php
+++ b/wp-admin/plugin-editor.php
@@ -34,6 +34,8 @@ switch($action) {
 
 case 'update':
 
+       check_admin_referer('edit-plugin_' . $file);
+
        if ( !current_user_can('edit_plugins') )
        die('<p>'.__('You have do not have sufficient permissions to edit templates for this blog.').'</p>');
 
@@ -42,9 +44,9 @@ case 'update':
                $f = fopen($real_file, 'w+');
                fwrite($f, $newcontent);
                fclose($f);
-               header("Location: plugin-editor.php?file=$file&a=te");
+               wp_redirect("plugin-editor.php?file=$file&a=te");
        } else {
-               header("Location: plugin-editor.php?file=$file");
+               wp_redirect("plugin-editor.php?file=$file");
        }
 
        exit();
@@ -95,6 +97,7 @@ if ($plugin_files) :
 </div>
        <?php   if (!$error) { ?> 
   <form name="template" id="template" action="plugin-editor.php" method="post">
+  <?php wp_nonce_field('edit-plugin_' . $file) ?>
                 <div><textarea cols="70" rows="25" name="newcontent" id="newcontent" tabindex="1"><?php echo $content ?></textarea> 
      <input type="hidden" name="action" value="update" /> 
      <input type="hidden" name="file" value="<?php echo $file ?>" />