← All changes | includes/classes/ObjectCache.php +10 -3 2.0.3 → trunk View file →

		@@ -89,24 +89,31 @@
89	89	*
90	90	* @since 1.0
91	91	*/
92	92	public function purge_object_cache() {
93		- if ( ! wp_verify_nonce( $_GET['_wpnonce'], 'powered_cache_purge_object_cache' ) ) {
	93	+ $nonce = isset( $_GET['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ) : '';
	94	+ if ( ! wp_verify_nonce( $nonce, 'powered_cache_purge_object_cache' ) ) {
94	95	wp_nonce_ays( '' );
95	96	}
96	97
97	98	if ( is_multisite() && ! current_user_can( 'manage_network' ) ) {
98	99	$redirect_url = add_query_arg( 'pc_action', 'flush_object_cache_err_permission', wp_get_referer() );
99		- wp_safe_redirect( $redirect_url );
	100	+ wp_safe_redirect( esc_url_raw( $redirect_url ) );
100	101	exit;
101	102	}
102	103
	104	+ if ( ! current_user_can( 'manage_options' ) ) {
	105	+ $redirect_url = add_query_arg( 'pc_action', 'flush_object_cache_err_permission', wp_get_referer() );
	106	+ wp_safe_redirect( esc_url_raw( $redirect_url ) );
	107	+ exit;
	108	+ }
	109	+
103	110	if ( function_exists( 'wp_cache_flush' ) ) {
104	111	wp_cache_flush();
105	112	}
106	113
107	114	$redirect_url = add_query_arg( 'pc_action', 'flush_object_cache', wp_get_referer() );
108		- wp_safe_redirect( $redirect_url );
	115	+ wp_safe_redirect( esc_url_raw( $redirect_url ) );
109	116	exit;
110	117	}
111	118
112	119