Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-06-26 06:45:07 +02:00
Code Issues Projects Releases Wiki Activity

Security, Site Health: Do not store HTTPS request error messages in an option.

Browse Source 
This changes the logic in `update_https_detection_errors()` to never store error messages from the actual request since they could use a different encoding, which would make storing them in an option potentially fail, leading WordPress to then falsely assume that HTTPS is supported.

While this doesn't actually fix the encoding issue, it is not crucial to do so anyway, since these messages are not used anywhere. A simple differentiation between whether the overall HTTPS request or only the SSL verification failed should be sufficient for the purpose of this function.

Props flixos90, tmatsuur, lukecarbis.
Fixes #52484.
Built from https://develop.svn.wordpress.org/trunk@50471


git-svn-id: http://core.svn.wordpress.org/trunk@50082 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2021-03-02 15:08:09 +00:00
parent c2f6f53b9b
commit e1239d91a9
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wp-includes/https-detection.php
View File

@ -130,13 +130,13 @@ function wp_update_https_detection_errors() {
if ( is_wp_error( $unverified_response ) ) {
$support_errors->add(
$unverified_response->get_error_code(),
$unverified_response->get_error_message()
'https_request_failed',
__( 'HTTPS request failed.' )
);
} else {
$support_errors->add(
'ssl_verification_failed',
$response->get_error_message()
__( 'SSL verification failed.' )
);
}

2
wp-includes/version.php
View File

@ -13,7 +13,7 @@
*
* @global string $wp_version
*/
$wp_version = '5.8-alpha-50466';
$wp_version = '5.8-alpha-50471';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.