Changeset 12075

Timestamp:

09/20/2022 06:25:36 AM (2 years ago)

Author:

dd32

Message:

Login: Check the data type of the passed data, this prevents PHP Notices when junk input is provided to the public login/register forms.

Location:

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login

Files:

• login.php (modified) (1 diff)
• register.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/login.php

@@ -10 +10 @@
 // Prefill the username if possible.
 $username = $_REQUEST['user'] ?? ( wp_parse_auth_cookie()['username'] ?? '' );
+if ( ! is_string( $username ) ) {
+    $username = '';
+}
 
 // Redirect is validated at redirect time, just pass through whatever we can.
-if ( !empty( $_REQUEST['redirect_to'] ) ) {
+if ( ! empty( $_REQUEST['redirect_to'] ) ) {
     $redirect = wp_unslash( $_REQUEST['redirect_to'] );
 } elseif ( $referer = wp_get_referer() ) {

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

@@ -6 +6 @@
  */
 
-$user_login       = isset( $_POST['user_login'] ) ? trim( wp_unslash( $_POST['user_login'] ) ) : '';
-$user_email       = isset( $_POST['user_email'] ) ? trim( wp_unslash( $_POST['user_email'] ) ) : '';
+$user_login       = isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ? trim( wp_unslash( $_POST['user_login'] ) ) : '';
+$user_email       = isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ? trim( wp_unslash( $_POST['user_email'] ) ) : '';
 $user_mailinglist = isset( $_POST['user_mailinglist'] ) && 'true' == $_POST['user_mailinglist'];
-$terms_of_service = isset( $_POST['terms_of_service'] ) ? $_POST['terms_of_service'] : false;
+$terms_of_service = isset( $_POST['terms_of_service'] ) ? intval( $_POST['terms_of_service'] ) : false;
 
 if ( ! $user_login && ! empty( WP_WPOrg_SSO::$matched_route_params['user'] ) ) {