Changeset 9800 for sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php

Timestamp:

05/01/2020 02:48:37 AM (5 years ago)

Author:

dd32

Message:

Bad Request: Block invalid submissions to the Jetpack Subscription Widget.

See ​https://github.com/Automattic/jetpack/pull/15638

File:

• sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/mu-plugins/pub/wporg-bad-request.php

@@ -70 +70 @@
 
 /**
+ * Detect invalid parameters being passed to the Jetpack Subscription widget.
+ * 
+ * @see https://github.com/Automattic/jetpack/pull/15638
+ */
+add_action( 'template_redirect', function() {
+    if (
+        isset( $_REQUEST['action'], $_REQUEST['email'], $_REQUEST['redirect_fragment'] )
+        && 'subscribe' === $_REQUEST['action']
+    ) {
+        if ( ! is_string( $_REQUEST['email'] ) || ! is_string( $_REQUEST['redirect_fragment'] ) ) {
+            die_bad_request( "non-scalar input to Jetpack Subscribe widget" );
+        }
+    }
+}, 9 );
+
+/**
  * Die with a 400 Bad Request.
  *