WordPress.org
Get WordPress

Make WordPress Core

Ticket #62794: user_password_array.diff

File user_password_array.diff, 537 bytes (added by leedxw, 20 months ago)

patch for user.php to check $_POSTpwd is a string

  • wp-includes/user.php 

    diff --git a/wp-includes/user.php b/wp-includes/user.php
index 700a7589..4fbb9df9 100644
    a b function wp_signon( $credentials = array(), $secure_cookie = '' ) {  
    5151                if ( ! empty( $_POST['log'] ) ) {
    5252                        $credentials['user_login'] = wp_unslash( $_POST['log'] );
    5353                }
    54                 if ( ! empty( $_POST['pwd'] ) ) {
     54                if ( ! empty( $_POST['pwd'] ) && is_string( $_POST['pwd'] ) ) {
    5555                        $credentials['user_password'] = $_POST['pwd'];
    5656                }
    5757                if ( ! empty( $_POST['rememberme'] ) ) {