Changeset 12075 for sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

Timestamp:

09/20/2022 06:25:36 AM (3 years ago)

Author:

dd32

Message:

Login: Check the data type of the passed data, this prevents PHP Notices when junk input is provided to the public login/register forms.

File:

• sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/register.php

@@ -6 +6 @@
  */
 
-$user_login       = isset( $_POST['user_login'] ) ? trim( wp_unslash( $_POST['user_login'] ) ) : '';
-$user_email       = isset( $_POST['user_email'] ) ? trim( wp_unslash( $_POST['user_email'] ) ) : '';
+$user_login       = isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ? trim( wp_unslash( $_POST['user_login'] ) ) : '';
+$user_email       = isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ? trim( wp_unslash( $_POST['user_email'] ) ) : '';
 $user_mailinglist = isset( $_POST['user_mailinglist'] ) && 'true' == $_POST['user_mailinglist'];
-$terms_of_service = isset( $_POST['terms_of_service'] ) ? $_POST['terms_of_service'] : false;
+$terms_of_service = isset( $_POST['terms_of_service'] ) ? intval( $_POST['terms_of_service'] ) : false;
 
 if ( ! $user_login && ! empty( WP_WPOrg_SSO::$matched_route_params['user'] ) ) {