Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Login and Registration: Prevent PHP warnings when POSTing to `wp-login.php` with an array as a `user_login` or `user_email` field. 

Props menakas, johnjamesjacoby.
Fixes #40888.
Built from https://develop.svn.wordpress.org/trunk@41782


git-svn-id: http://core.svn.wordpress.org/trunk@41616 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2017-10-06 17:37:47 +00:00
parent 53a58e35b7
commit 806c464e4b
2 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '4.9-beta1-41781'; $wp_version = '4.9-beta1-41782';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

19
wp-login.php
View File

@ -298,7 +298,7 @@ function wp_login_viewport_meta() {
function retrieve_password() { function retrieve_password() {
$errors = new WP_Error(); $errors = new WP_Error();
if ( empty( $_POST['user_login'] ) ) { if ( empty( $_POST['user_login'] ) || ! is_string( $_POST['user_login'] ) ) {
$errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.')); $errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));
} elseif ( strpos( $_POST['user_login'], '@' ) ) { } elseif ( strpos( $_POST['user_login'], '@' ) ) {
$user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) ); $user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) );
@ -565,7 +565,11 @@ case 'retrievepassword' :
login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors); login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
$user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : ''; $user_login = '';
if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
$user_login = wp_unslash( $_POST['user_login'] );
}
?> ?>
@ -757,9 +761,16 @@ case 'register' :
$user_login = ''; $user_login = '';
$user_email = ''; $user_email = '';
if ( $http_post ) { if ( $http_post ) {
$user_login = isset( $_POST['user_login'] ) ? $_POST['user_login'] : ''; if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
$user_email = isset( $_POST['user_email'] ) ? wp_unslash( $_POST['user_email'] ) : ''; $user_login = $_POST['user_login'];
}
if ( isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ) {
$user_email = wp_unslash( $_POST['user_email'] );
}
$errors = register_new_user($user_login, $user_email); $errors = register_new_user($user_login, $user_email);
if ( !is_wp_error($errors) ) { if ( !is_wp_error($errors) ) {
$redirect_to = !empty( $_POST['redirect_to'] ) ? $_POST['redirect_to'] : 'wp-login.php?checkemail=registered'; $redirect_to = !empty( $_POST['redirect_to'] ) ? $_POST['redirect_to'] : 'wp-login.php?checkemail=registered';