Ticket #63137: 63137.5.patch

src/wp-includes/class-wp-application-passwords.php

@@ -347 +347 @@
                         }
 
                         $password['last_used'] = time();
-                        $password['last_ip']   = $_SERVER['REMOTE_ADDR'];
+                        $password['last_ip']   = isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : null;
 
                         $saved = static::set_user_application_passwords( $user_id, $passwords );
 

src/wp-includes/template-loader.php

@@ -23 +23 @@
  *
  * @param bool $exit Whether to exit without generating any content for 'HEAD' requests. Default true.
  */
-if ( 'HEAD' === $_SERVER['REQUEST_METHOD'] && apply_filters( 'exit_on_http_head', true ) ) {
+if ( ( isset( $_SERVER['REQUEST_METHOD'] ) && 'HEAD' === $_SERVER['REQUEST_METHOD'] ) && apply_filters( 'exit_on_http_head', true ) ) {
         exit;
 }
 

src/wp-includes/user.php

@@ -3303 +3303 @@
         $message .= network_site_url( 'wp-login.php?login=' . rawurlencode( $user_login ) . "&key=$key&action=rp", 'login' ) . '&wp_lang=' . $locale . "\r\n\r\n";
 
         if ( ! is_user_logged_in() ) {
-                $requester_ip = $_SERVER['REMOTE_ADDR'];
+                $requester_ip = isset( $_SERVER['REMOTE_ADDR'] ) ? wp_unslash( $_SERVER['REMOTE_ADDR'] ) : '';
                 if ( $requester_ip ) {
                         $message .= sprintf(
                                 /* translators: %s: IP address of password reset requester. */