From cf4f8d87378852ed9fba53bbc2d4074fba92e12a Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Mon, 16 Jul 2018 14:10:26 +0000 Subject: [PATCH] Login and Registration: Set a better default value for `$wp_error` parameter in `login_header()`. To prevent someone from passing a string (which would not be added to a new `WP_Error` instance), check for `is_wp_error()` explicitly. Props desrosj, chetan200891, spyderbytes, lbenicio, sebastien@thivinfo.com, abdullahramzan. Fixes #44052. Built from https://develop.svn.wordpress.org/trunk@43457 git-svn-id: http://core.svn.wordpress.org/trunk@43284 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/version.php | 2 +- wp-login.php | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/wp-includes/version.php b/wp-includes/version.php index 715ccff74f..13a2bcec3e 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '5.0-alpha-43454'; +$wp_version = '5.0-alpha-43457'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. diff --git a/wp-login.php b/wp-login.php index e02208ae56..b0117ed8fa 100644 --- a/wp-login.php +++ b/wp-login.php @@ -28,9 +28,9 @@ if ( force_ssl_admin() && ! is_ssl() ) { * @param string $title Optional. WordPress login Page title to display in the `` element. * Default 'Log In'. * @param string $message Optional. Message to display in header. Default empty. - * @param WP_Error $wp_error Optional. The error to pass. Default empty. + * @param WP_Error $wp_error Optional. The error to pass. Default is a WP_Error instance. */ -function login_header( $title = 'Log In', $message = '', $wp_error = '' ) { +function login_header( $title = 'Log In', $message = '', $wp_error = null ) { global $error, $interim_login, $action; // Don't index any of these forms @@ -38,7 +38,7 @@ function login_header( $title = 'Log In', $message = '', $wp_error = '' ) { add_action( 'login_head', 'wp_login_viewport_meta' ); - if ( empty( $wp_error ) ) { + if ( ! is_wp_error( $wp_error ) ) { $wp_error = new WP_Error(); }