Changeset 14366

Timestamp:

01/21/2025 05:33:09 AM (19 months ago)

Author:

dd32

Message:

Plugin Directory: API: Only validate that the locale appears to be a string, rather than a valid locale.

This can cause clients which have invalid locales set on their site to no longer be able to interact with the plugin directory.

See ​https://core.trac.wordpress.org/ticket/62832.
See [14344].

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/standalone/class-plugins-info-api-request.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/standalone/class-plugins-info-api-request.php

@@ -330 +330 @@
                 }
 
-                // Validate the locale is in an expected supported format, for all endpoints.
-                if (
-                        ! is_string( $this->locale ) ||
-                        ! preg_match( '!^[a-z]{2,3}(_([A-Z]{2}))?(_([a-z0-9]+))?$!', $this->locale )
-                ) {
+                /*
+                 * Validate the locale is in an expected supported format, for all endpoints.
+                 *
+                 * Note: Do not validate the locale is valid, as this will cause the endpoints to not
+                 *       fail for WordPress sites with malformed WPLOCALE constants on their site.
+                 *       By only validating it's a string, we're ensuring that only non-WordPress clients
+                 *       should ever hit a block due to invalid passed data.
+                 */
+                if ( ! is_string( $this->locale ) ) {
                         return false;
                 }