Merge pull request #16877 from nicoladj77/patch-1

Check for nonce when Cancelling Order.
2017-09-21 10:27:12 -07:00 · 2017-09-21 10:27:12 -07:00 · abc43c473e
parent e713b5beb3 74bea6ec7d
commit abc43c473e
1 changed files with 6 additions and 1 deletions
--- a/includes/class-wc-form-handler.php
+++ b/includes/class-wc-form-handler.php
@ -672,7 +672,12 @@ class WC_Form_Handler {
 	 * Cancel a pending order.
 	 */
 	public static function cancel_order() {
-		if ( isset( $_GET['cancel_order'] ) && isset( $_GET['order'] ) && isset( $_GET['order_id'] ) ) {
+		if (
+			isset( $_GET['cancel_order'] ) &&
+			isset( $_GET['order'] ) &&
+			isset( $_GET['order_id'] ) &&
+			( isset( $_GET['_wpnonce'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'woocommerce-cancel_order' ) )
+		) {
 			nocache_headers();

 			$order_key        = $_GET['order'];