Changeset 11381

Timestamp:

12/16/2021 04:21:13 AM (5 years ago)

Author:

dd32

Message:

Plugin Directory: Readme Validator: Protect inputs against vulnerability scanners sending junk inputs.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-readme-validator.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-readme-validator.php

@@ -18 +18 @@
                         }
 
-                        $readme_url      = $_REQUEST['readme'] ?? '';
-                        $readme_contents = $_POST['readme_contents'] ?? '';
-                        $readme_contents = base64_decode( wp_unslash( $readme_contents ) );
+                        $readme_url      = '';
+                        $readme_contents = '';
+                        if ( ! empty( $_REQUEST['readme'] ) && is_string( $_REQUEST['readme'] ) ) {
+                                $readme_url = $_REQUEST['readme'];
+                        }
+                        if ( ! empty( $_POST['readme_contents'] ) && is_string( $_POST['readme_contents'] ) ) {
+                                $readme_contents = base64_decode( wp_unslash( $_POST['readme_contents'] ) );
+                        }
                         ?>
 
@@ -59 +64 @@
          */
         protected static function validate_readme() {
-                if ( ! empty( $_REQUEST['readme'] ) ) {
+                if ( ! empty( $_REQUEST['readme'] ) && is_string( $_REQUEST['readme'] ) ) {
                         $errors = Validator::instance()->validate_url( wp_unslash( $_REQUEST['readme'] ) );
 
-                } elseif ( ! empty( $_POST['readme_contents'] ) ) {
+                } elseif ( ! empty( $_POST['readme_contents'] ) && is_string( $_POST['readme_contents'] ) ) {
                         $errors = Validator::instance()->validate_content( base64_decode( wp_unslash( $_REQUEST['readme_contents'] ) ) );