Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Multisite: Verify the signup nonce using `wp_verify_nonce()` in `signup_nonce_check()`. 

Prior to this change, the nonce passed from `wp-signup.php` was verified with a simple comparison. Furthermore in case of failures, `wp_die()` would be called right during the HTML markup being already printed. Now the error message is returned properly, modifying the `WP_Error` object in the passed `$result`.

Props herregroen.
Fixes #43667.

Built from https://develop.svn.wordpress.org/trunk@42976


git-svn-id: http://core.svn.wordpress.org/trunk@42805 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Felix Arntz 2018-04-13 15:30:20 +00:00
parent 888236585c
commit 35cdc99039
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
wp-includes/ms-functions.php
View File

@ -2193,8 +2193,8 @@ function signup_nonce_check( $result ) {
return $result;
}
if ( wp_create_nonce( 'signup_form_' . $_POST['signup_form_id'] ) != $_POST['_signup_form'] ) {
wp_die( __( 'Please try again.' ) );
if ( ! wp_verify_nonce( $_POST['_signup_form'], 'signup_form_' . $_POST['signup_form_id'] ) ) {
$result['errors']->add( 'invalid_nonce', __( 'Unable to submit this form, please try again.' ) );
}
return $result;

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.0-alpha-42975';
$wp_version = '5.0-alpha-42976';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.