Changeset 10998 for sites/trunk/api.wordpress.org/public_html/translations/core/1.0/index.php

Timestamp:

05/27/2021 12:42:54 AM (4 years ago)

Author:

dd32

Message:

Translations API: Harden the API against invalid input.

This prevents PHP Warnings and hopefully will flag to users of the API when they call it incorrectly.

File:

• sites/trunk/api.wordpress.org/public_html/translations/core/1.0/index.php (modified) (1 diff)

sites/trunk/api.wordpress.org/public_html/translations/core/1.0/index.php

@@ -8 +8 @@
 wp_cache_init();
 
-$version = isset( $_REQUEST['version'] ) ? str_replace( '-src', '', $_REQUEST['version'] ) : WP_CORE_LATEST_RELEASE;
+$version = WP_CORE_LATEST_RELEASE;
+if ( isset( $_REQUEST['version'] ) ) {
+    $version = $_REQUEST['version'];
+    if ( ! is_string( $version ) || ! is_numeric( $version[0] ) ) {
+        header( $_SERVER['SERVER_PROTOCOL'] . ' 400 Bad Request' );
+        die( '?version= must be a valid WordPress version' );
+    }
+
+    $version = str_replace( '-src', '', $version );
+}
 
 $translations = find_all_translations_for_core( $version );