Merge branch 'release/1.0.7'

getgrav · Jan 7, 2016 · 8ca14c7 · 8ca14c7
2 parents 4549574 + eff72b7
commit 8ca14c7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -31,6 +31,7 @@
     * Fix for markdown attributes on external URLs
     * Fixed issue where `data:` page header was acting as `publish_date:`
     * Fix for special characters in URL parameters (e.g. /tag:c++) #541
+    * Safety check for an array of nonces to only use the first one
 
 # v1.0.6
 ## 12/22/2015

diff --git a/system/src/Grav/Common/Utils.php b/system/src/Grav/Common/Utils.php
@@ -560,6 +560,11 @@ public static function getNonceOldStyle($action, $plusOneTick = false)
      */
     public static function verifyNonce($nonce, $action)
     {
+        //Safety check for multiple nonces
+        if (is_array($nonce)) {
+            $nonce = array_shift($nonce);
+        }
+
         //Nonce generated 0-12 hours ago
         if ($nonce == self::getNonce($action)) {
             return true;