sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Login and Registration: Prevent PHP warnings when POSTing to wp-login.php with an array as a user_login or user_email field.

Browse Source 
Props menakas, johnjamesjacoby.
Fixes #40888.

git-svn-id: https://develop.svn.wordpress.org/trunk@41782 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Sergey Biryukov 2017-10-06 17:36:12 +00:00
parent ea0481afdb
commit 59bd66aeec
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/wp-login.php
View File

@ -298,7 +298,7 @@ function wp_login_viewport_meta() {
function retrieve_password() { function retrieve_password() {
$errors = new WP_Error(); $errors = new WP_Error();
if ( empty( $_POST['user_login'] ) ) { if ( empty( $_POST['user_login'] ) || ! is_string( $_POST['user_login'] ) ) {
$errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.')); $errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));
} elseif ( strpos( $_POST['user_login'], '@' ) ) { } elseif ( strpos( $_POST['user_login'], '@' ) ) {
$user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) ); $user_data = get_user_by( 'email', trim( wp_unslash( $_POST['user_login'] ) ) );
@ -565,7 +565,11 @@ case 'retrievepassword' :
login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors); login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
$user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : ''; $user_login = '';
if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
$user_login = wp_unslash( $_POST['user_login'] );
}
?> ?>
@ -757,9 +761,16 @@ case 'register' :
$user_login = ''; $user_login = '';
$user_email = ''; $user_email = '';
if ( $http_post ) { if ( $http_post ) {
$user_login = isset( $_POST['user_login'] ) ? $_POST['user_login'] : ''; if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
$user_email = isset( $_POST['user_email'] ) ? wp_unslash( $_POST['user_email'] ) : ''; $user_login = $_POST['user_login'];
}
if ( isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ) {
$user_email = wp_unslash( $_POST['user_email'] );
}
$errors = register_new_user($user_login, $user_email); $errors = register_new_user($user_login, $user_email);
if ( !is_wp_error($errors) ) { if ( !is_wp_error($errors) ) {
$redirect_to = !empty( $_POST['redirect_to'] ) ? $_POST['redirect_to'] : 'wp-login.php?checkemail=registered'; $redirect_to = !empty( $_POST['redirect_to'] ) ? $_POST['redirect_to'] : 'wp-login.php?checkemail=registered';