Wordpress 2.0.4

[autoinstalls/wordpress.git] / wp-admin / plugins.php

diff --git a/wp-admin/plugins.php b/wp-admin/plugins.php
index 69d31ec0103415f21babddd30be2f139f5ad6932..9424b39826d87868259333f49b232547c304d5e4 100644 (file)
--- a/wp-admin/plugins.php
+++ b/wp-admin/plugins.php
@@ -2,9 +2,8 @@
 require_once('admin.php');
 
 if ( isset($_GET['action']) ) {
-       check_admin_referer();
-       
        if ('activate' == $_GET['action']) {
+               check_admin_referer('activate-plugin_' . $_GET['plugin']);
                $current = get_settings('active_plugins');
                if (!in_array($_GET['plugin'], $current)) {
                        $current[] = trim( $_GET['plugin'] );
@@ -13,13 +12,14 @@ if ( isset($_GET['action']) ) {
                        include(ABSPATH . 'wp-content/plugins/' . trim( $_GET['plugin'] ));
                        do_action('activate_' . trim( $_GET['plugin'] ));
                }
-               header('Location: plugins.php?activate=true');
+               wp_redirect('plugins.php?activate=true');
        } else if ('deactivate' == $_GET['action']) {
+               check_admin_referer('deactivate-plugin_' . $_GET['plugin']);
                $current = get_settings('active_plugins');
                array_splice($current, array_search( $_GET['plugin'], $current), 1 ); // Array-fu!
                update_option('active_plugins', $current);
                do_action('deactivate_' . trim( $_GET['plugin'] ));
-               header('Location: plugins.php?deactivate=true');
+               wp_redirect('plugins.php?deactivate=true');
        }
        exit;
 }
@@ -98,11 +98,11 @@ if (empty($plugins)) {
                $style = ('class="alternate"' == $style|| 'class="alternate active"' == $style) ? '' : 'alternate';
 
                if (!empty($current_plugins) && in_array($plugin_file, $current_plugins)) {
-                       $action = "<a href='plugins.php?action=deactivate&amp;plugin=$plugin_file' title='".__('Deactivate this plugin')."' class='delete'>".__('Deactivate')."</a>";
+                       $action = "<a href='" . wp_nonce_url("plugins.php?action=deactivate&amp;plugin=$plugin_file", 'deactivate-plugin_' . $plugin_file) . "' title='".__('Deactivate this plugin')."' class='delete'>".__('Deactivate')."</a>";
                        $plugin_data['Title'] = "<strong>{$plugin_data['Title']}</strong>";
                        $style .= $style == 'alternate' ? ' active' : 'active';
                } else {
-                       $action = "<a href='plugins.php?action=activate&amp;plugin=$plugin_file' title='".__('Activate this plugin')."' class='edit'>".__('Activate')."</a>";
+                       $action = "<a href='" . wp_nonce_url("plugins.php?action=activate&amp;plugin=$plugin_file", 'activate-plugin_' . $plugin_file) . "' title='".__('Activate this plugin')."' class='edit'>".__('Activate')."</a>";
                }
                $plugin_data['Description'] = wp_kses($plugin_data['Description'], array('a' => array('href' => array(),'title' => array()),'abbr' => array('title' => array()),'acronym' => array('title' => array()),'code' => array(),'em' => array(),'strong' => array()) ); ;
                if ($style != '') $style = 'class="' . $style . '"';