Changeset 24462

Timestamp:

06/21/2013 02:15:55 AM (12 years ago)

Author:

nacin

Message:

Add strict check to wp_verify_nonce() to avoid issues when it is improperly called.

Merges [24461] to the 3.5 branch.

Location:

branches/3.5

Files:

• . (modified) (1 prop)
• wp-includes/pluggable.php (modified) (1 diff)

branches/3.5/wp-includes/pluggable.php

@@ -1258 +1258 @@
 
     // Nonce generated 0-12 hours ago
-    if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) == $nonce )
+    if ( substr(wp_hash($i . $action . $uid, 'nonce'), -12, 10) === $nonce )
         return 1;
     // Nonce generated 12-24 hours ago
-    if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) == $nonce )
+    if ( substr(wp_hash(($i - 1) . $action . $uid, 'nonce'), -12, 10) === $nonce )
         return 2;
     // Invalid nonce