LiftUX/UpThemes-Framework — pull request #35 by tommcfarlin (2012-07-11 19:34:58+00:00)
Title: Improving security of file uploads via Ajax and bringing the Upload File script up to WordPress coding standards

* Introducing a WordPress-generated nonce to the upload-file.php ajax call for file uploads.

* Using `get_template_directory_uri()` rather than `THEME_DIR` when making the request to `upload-files.php`

* Updating `upload-file.php` to follow the [coding standards](http://codex.wordpress.org/WordPress_Coding_Standards)

* Verifying that the file uploads are performed by a user who can manage options (that is, an administrator)

* Verifying that the nonce is set and requested corresponds to the value generated by WordPress

* That the `$_FILES` security key is set

**Note**: This fix does assume that the file resides in a typical `/wp-content/themes/` directory (see the comment on lines 3 - 4 of `upload-file.php`)