Changeset 10338

Timestamp:

10/01/2020 07:31:42 AM (4 years ago)

Author:

dd32

Message:

WordPress.org: Account Deletion: Only process requests that provide a valid email form value.

File:

• sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/inc/privacy-functions.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-main/inc/privacy-functions.php

@@ -25 +25 @@
     $nonce_action  = 'request_' . $type;
 
-    if ( empty( $_POST['email'] ) || ! $type || ! in_array( $type, [ 'erase', 'export' ], true ) ) {
+    if ( empty( $_POST['email'] ) || ! is_string( $_POST['email'] ) || ! $type || ! in_array( $type, [ 'erase', 'export' ], true ) ) {
         return compact( 'email', 'error_message', 'success', 'nonce_action' );
     }