Ticket #10454 (closed enhancement: fixed)

Opened 3 years ago

Last modified 3 years ago

Add support for setting users_can_register option via XML-RPC and sanitize the option value

Reported by: josephscott Owned by: westi
Priority: normal Milestone: 2.9
Component: XML-RPC Version: 2.8.1
Severity: normal Keywords: has-patch
Cc: joseph@…

Description

I looked at adding support to manage the users_can_register ('Membership') option via XML-RPC (using the existing wp.setOptions method) and found that the users_can_register value wasn't being sanitized. There was also a problem with wp.setOptions not working if the value of the option evaluated to false with the empty() function.

So first up, I have a patch to xmlrpc.php that adds support for managing the users_can_register option and removes the empty() check on the option value.

Second is a patch to the sanitize_option() function that makes sure that the value for the users_can_register option is an integer. Under normal situations this limits the value to either zero or one.

Attachments

xmlrpc.php.diff Download (666 bytes) - added by josephscott 3 years ago.
wp-includes--formatting.php.diff Download (412 bytes) - added by josephscott 3 years ago.
wp-includes--formatting.php.2.diff Download (447 bytes) - added by josephscott 3 years ago.

Change History

Westi pointed out that there really is no reason not to use absint() here instead, since the two legal values we are talking about are zero and one. This new patch puts 'users_can_register' into the same case block for other absolute integers and replaces the abs((int) *) approach with a call to absint().

  • Owner changed from josephscott to westi
  • Status changed from new to reviewing

(In [11772]) Ensure that users_can_register is sanitised correctly. See #10454 props josephscott.

  • Status changed from reviewing to closed
  • Resolution set to fixed

(In [11773]) Allow user registration to be enabled by an XMLRPC client. Fixes #10454 props josephscott.

Note: See TracTickets for help on using tickets.