Steve-Dee-Designs
/
woocommerce
mirror of https://github.com/woocommerce/woocommerce.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add a nonce and confirmation for logging out via the customer my account page

This commit is contained in:
Mike Jolley 2017-06-12 14:02:29 +01:00
parent 396c8aa4fc
commit 636ad8b652
3 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
includes/shortcodes/class-wc-shortcode-my-account.php
View File

@ -56,10 +56,14 @@ class WC_Shortcode_My_Account {
} else {
wc_get_template( 'myaccount/form-login.php' );
}
} else {
} else {
// Start output buffer since the html may need discarding for BW compatibility
ob_start();
if ( isset( $wp->query_vars['customer-logout'] ) ) {
wc_add_notice( sprintf( __( 'Are you sure you want to log out? <a href="%s">Confirm and log out</a>', 'woocommerce' ), wc_logout_url() ) );
}
// Collect notices before output
$notices = wc_get_notices();

4
includes/wc-template-functions.php
View File

@ -33,7 +33,7 @@ function wc_template_redirect() {
wp_redirect( wc_get_page_permalink( 'cart' ) );
exit;
} elseif ( isset( $wp->query_vars['customer-logout'] ) ) {
} elseif ( isset( $wp->query_vars['customer-logout'] ) && ! empty( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( $_REQUEST['_wpnonce'], 'customer-logout' ) ) {
// Logout
wp_redirect( str_replace( '&amp;', '&', wp_logout_url( wc_get_page_permalink( 'myaccount' ) ) ) );
@ -2646,7 +2646,7 @@ function wc_logout_url( $redirect = '' ) {
$redirect = $redirect ? $redirect : wc_get_page_permalink( 'myaccount' );
if ( $logout_endpoint ) {
return wc_get_endpoint_url( 'customer-logout', '', $redirect );
return wp_nonce_url( wc_get_endpoint_url( 'customer-logout', '', $redirect ), 'customer-logout' );
} else {
return wp_logout_url( $redirect );
}

2
templates/myaccount/dashboard.php
View File

@ -26,7 +26,7 @@ if ( ! defined( 'ABSPATH' ) ) {
<p><?php
/* translators: 1: user display name 2: logout url */
printf(
__( 'Hello %1$s (not %1$s? <a href="%2$s">Sign out</a>)', 'woocommerce' ),
__( 'Hello %1$s (not %1$s? <a href="%2$s">Log out</a>)', 'woocommerce' ),
'<strong>' . esc_html( $current_user->display_name ) . '</strong>',
esc_url( wc_logout_url( wc_get_page_permalink( 'myaccount' ) ) )
);