From 289581e28084bed8f0e2e81143efc0d9dca83e1b Mon Sep 17 00:00:00 2001
From: John Blackbourn <johnbillion@git.wordpress.org>
Date: Sun, 28 Aug 2016 17:30:29 +0000
Subject: [PATCH] Security: Return a `403` instead of a `200` HTTP status when
 `check_ajax_referer()` fails.

This is, unfortunately, untestable in the current test suite, even in the AJAX tests.

Fixes #36362


git-svn-id: https://develop.svn.wordpress.org/trunk@38421 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/functions.php | 16 +++++++++++++---
 src/wp-includes/pluggable.php |  2 +-
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 23fc15cd1b..d3a8bcd2d7 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -2861,9 +2861,19 @@ function _xmlrpc_wp_die_handler( $message, $title = '', $args = array() ) {
  * @since 3.4.0
  * @access private
  *
- * @param string $message Optional. Response to print. Default empty.
- */
-function _ajax_wp_die_handler( $message = '' ) {
+ * @param string       $message Error message. 
+ * @param string       $title   Optional. Error title (unused). Default empty. 
+ * @param string|array $args    Optional. Arguments to control behavior. Default empty array. 
+ */ 
+function _ajax_wp_die_handler( $message, $title = '', $args = array() ) { 
+	$defaults = array( 
+		'response' => 200, 
+	); 
+	$r = wp_parse_args( $args, $defaults ); 
+
+	if ( ! headers_sent() ) { 
+		status_header( $r['response'] ); 
+	}
 	if ( is_scalar( $message ) )
 		die( (string) $message );
 	die( '0' );
diff --git a/src/wp-includes/pluggable.php b/src/wp-includes/pluggable.php
index dc10c7f393..fe4c0a9933 100644
--- a/src/wp-includes/pluggable.php
+++ b/src/wp-includes/pluggable.php
@@ -1108,7 +1108,7 @@ function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
 
 	if ( $die && false === $result ) {
 		if ( wp_doing_ajax() ) {
-			wp_die( -1 );
+			wp_die( -1, 403 );
 		} else {
 			die( '-1' );
 		}