Changeset 24461 for trunk/wp-includes/pluggable.php

Timestamp:

06/21/2013 02:11:31 AM (12 years ago)

Author:

nacin

Message:

Add strict check to wp_verify_nonce() to avoid issues when it is improperly called.

File:

• trunk/wp-includes/pluggable.php (modified) (1 diff)

trunk/wp-includes/pluggable.php

@@ -1260 +1260 @@
 
     // Nonce generated 0-12 hours ago
-    if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) == $nonce )
+    if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
         return 1;
     // Nonce generated 12-24 hours ago
-    if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) == $nonce )
+    if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
         return 2;
     // Invalid nonce