Changeset 11073 for sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

Timestamp:

06/29/2021 03:33:09 AM (3 years ago)

Author:

dd32

Message:

Login: Properly URL encode parameters before passing them in the URI for internal REST API requests.

This avoids PHP Notices when bots attempt to create accounts with linebreaks in the fields.

File:

• sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

@@ -24 +24 @@
 if ( $_POST ) {
 
-    $error_user_login = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/username-available/' . $user_login ) );
+    $error_user_login = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/username-available/' . urlencode( $user_login ) ) );
     if ( $error_user_login->get_data()['available'] ) {
         $error_user_login = false;
     }
 
-    $error_user_email = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/email-in-use/' . $user_email ) );
+    $error_user_email = rest_do_request( new WP_REST_Request( 'GET', '/wporg/v1/email-in-use/' . urlencode( $user_email ) ) );
     if ( $error_user_email->get_data()['available'] ) {
         $error_user_email = false;