Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Login and Registration: Prevent PHP warnings when POSTing to `wp-login.php` with an array as a `user_login` or `user_email` field. 

Props menakas, johnjamesjacoby.
Fixes #40888.
Built from https://develop.svn.wordpress.org/trunk@41782


git-svn-id: http://core.svn.wordpress.org/trunk@41616 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2017-10-06 17:37:47 +00:00
parent 53a58e35b7
commit 806c464e4b
2 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '4.9-beta1-41781';
$wp_version = '4.9-beta1-41782';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

19
wp-login.php
View File

@ -298,7 +298,7 @@ function wp_login_viewport_meta() {
function retrieve_password() {
$errors = new WP_Error();
if ( empty( $_POST['user_login'] ) ) {
if ( empty( $_POST['user_login'] ) || ! is_string( $_POST['user_login'] ) ) {
$errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));
} elseif ( strpos( $_POST['user_login'], '@' ) ) {
$user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) );
@ -565,7 +565,11 @@ case 'retrievepassword' :
login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
$user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : '';
$user_login = '';
if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
$user_login = wp_unslash( $_POST['user_login'] );
}
?>
@ -757,9 +761,16 @@ case 'register' :
$user_login = '';
$user_email = '';
if ( $http_post ) {
$user_login = isset( $_POST['user_login'] ) ? $_POST['user_login'] : '';
$user_email = isset( $_POST['user_email'] ) ? wp_unslash( $_POST['user_email'] ) : '';
if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
$user_login = $_POST['user_login'];
}
if ( isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ) {
$user_email = wp_unslash( $_POST['user_email'] );
}
$errors = register_new_user($user_login, $user_email);
if ( !is_wp_error($errors) ) {
$redirect_to = !empty( $_POST['redirect_to'] ) ? $_POST['redirect_to'] : 'wp-login.php?checkemail=registered';