Wordpress Version 2.0.3 Review - WordPress had ensured...
(Page 4 of 6 )
WordPress had ensured you were safe from this kind of hacking by using a utility called HTTPREFERER. But this utility has some issues. For instance, with JavaScript in Internet Explorer, it can be spoofed. In addition, certain firewalls and proxies can strip the information it's supposed to carry out, causing some people to be unable to use their WordPress admin accounts the way they're supposed to be able to.
Now, instead of the HTTPREFERER, a nonce is used; this is a number used once. It's like a password that changes every twelve hours, and is valid for twenty-four hours. The nonce is unique to the specific WordPress install being used, the WordPress user logged in, the action, the object of the action, and the 24-hour time of the action. When any of these is changed, the nonce is no longer valid. All plugin authors will have to ensure the nonce is added to their forms and other interactive capabilities that may be affected.
Next: Upgrading from WordPress... >>
More Blog Help Articles
More By Jase Dow
