Changeset 45149

Timestamp:

04/09/2019 12:07:39 AM (6 years ago)

Author:

pento

Message:

Privacy: Add a missing <form> action on the Export/Erasure screens.

This lack of action could cause an expired nonce to end up in the URL.

Props garrett-eclipse, saimonh, xkon.
Fixes #44047.

File:

• trunk/src/wp-admin/includes/user.php (modified) (2 diffs)

trunk/src/wp-admin/includes/user.php

@@ -831 +831 @@
         <?php settings_errors(); ?>
 
-        <form method="post" class="wp-privacy-request-form">
+        <form action="<?php echo admin_url( 'tools.php?page=export_personal_data' ); ?>" method="post" class="wp-privacy-request-form">
             <h2><?php esc_html_e( 'Add Data Export Request' ); ?></h2>
             <p><?php esc_html_e( 'An email will be sent to the user at this email address asking them to verify the request.' ); ?></p>
@@ -915 +915 @@
         <?php settings_errors(); ?>
 
-        <form method="post" class="wp-privacy-request-form">
+        <form action="<?php echo admin_url( 'tools.php?page=remove_personal_data' ); ?>" method="post" class="wp-privacy-request-form">
             <h2><?php esc_html_e( 'Add Data Erasure Request' ); ?></h2>
             <p><?php esc_html_e( 'An email will be sent to the user at this email address asking them to verify the request.' ); ?></p>