Clearing cache security fix

Author: ajaydsouza

includes/admin/admin.php

@@ -131,6 +131,13 @@ function crp_load_admin_scripts( $hook ) {
 				),
 			)
 		);
+		wp_localize_script(
+			'crp-admin-js',
+			'crp_admin_data',
+			array(
+				'security' => wp_create_nonce( 'crp-admin' ),
+			)
+		);
 
 	}
 }

includes/admin/js/admin-scripts.js

@@ -2,15 +2,16 @@
 function crpClearCache() {
 	/**** since 2.8 ajaxurl is always defined in the admin header and points to admin-ajax.php ****/
 	jQuery.post(ajaxurl, {
-		action: 'crp_clear_cache'
+		action: 'crp_clear_cache',
+		security: crp_admin_data.security
 	}, function (response, textStatus, jqXHR) {
 		alert(response.message);
 	}, 'json');
 }
 
 jQuery(document).ready(function($) {
 	// Prompt the user when they leave the page without saving the form.
-	formmodified=0;
+	var formmodified=0;
 
 	function confirmFormChange() {
 		formmodified=1;

includes/admin/js/admin-scripts.min.js

@@ -17,6 +17,11 @@
  */
 function crp_ajax_clearcache() {
 
+	if ( ! current_user_can( 'manage_options' ) ) {
+		wp_die( 0 );
+	}
+	check_ajax_referer( 'crp-admin', 'security' );
+
 	crp_cache_delete();
 	exit(
 		wp_json_encode(