Changeset 19634 for branches/3.3/wp-includes/capabilities.php

Timestamp:

12/30/2011 07:34:59 PM (13 years ago)

Author:

ryan

Message:

Don't cast objects to int.

File:

• branches/3.3/wp-includes/capabilities.php (modified) (1 diff, 1 prop)

branches/3.3/wp-includes/capabilities.php

@@ -488 +488 @@
         global $wpdb;
 
-        if ( 'id' == $field )
+        if ( 'id' == $field ) {
+            // Make sure the value is numeric to avoid casting objects, for example,
+            // to int 1.
+            if ( ! is_numeric( $value ) )
+                return false;
             $value = absint( $value );
-        else
+        } else {
             $value = trim( $value );
+        }
 
         if ( !$value )