Changeset 11073

Timestamp:

06/29/2021 03:33:09 AM (3 years ago)

Author:

dd32

Message:

Login: Properly URL encode parameters before passing them in the URI for internal REST API requests.

This avoids PHP Notices when bots attempt to create accounts with linebreaks in the fields.

Location:

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login

Files:

• functions-registration.php (modified) (1 diff)
• register.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/functions-registration.php

@@ -367 +367 @@
     ) {
         // Validate the email
-        $error_user_email = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/email-in-use/' . $new_email ) );
+        $error_user_email = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/email-in-use/' . urlencode( $new_email ) ) );
         if ( $error_user_email->get_data()['available'] ) {
             // Change their email, resend confirmation.

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

@@ -24 +24 @@
 if ( $_POST ) {
 
-    $error_user_login = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/username-available/' . $user_login ) );
+    $error_user_login = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/username-available/' . urlencode( $user_login ) ) );
     if ( $error_user_login->get_data()['available'] ) {
         $error_user_login = false;
     }
 
-    $error_user_email = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/email-in-use/' . $user_email ) );
+    $error_user_email = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/email-in-use/' . urlencode( $user_email ) ) );
     if ( $error_user_email->get_data()['available'] ) {
         $error_user_email = false;