Changeset 29377 for trunk

Timestamp:

08/05/2014 06:49:22 AM (12 years ago)

Author:

nacin

Message:

Verify the MAC earlier in WP_Customize_Widgets. props duck_.

File:

• trunk/src/wp-includes/class-wp-customize-widgets.php (modified) (3 diffs)

trunk/src/wp-includes/class-wp-customize-widgets.php

@@ -1151 +1151 @@
 
         /**
-         * Get a widget instance's hash key.
-         *
-         * Serialize an instance and hash it with the AUTH_KEY; when a JS value is
-         * posted back to save, this instance hash key is used to ensure that the
-         * serialized_instance was not tampered with, but that it had originated
-         * from WordPress and so is sanitized.
+         * Get MAC for a serialized widget instance string.
+         *
+         * Allows values posted back from JS to be rejected if any tampering of the
+         * data has occurred.
          *
          * @since 3.9.0
          * @access protected
          *
-         * @param array $instance Widget instance.
-         * @return string Widget instance's hash key.
-         */
-        protected function get_instance_hash_key( $instance ) {
-                return wp_hash( serialize( $instance ) );
+         * @param string $serialized_instance Widget instance.
+         * @return string MAC for serialized widget instance.
+         */
+        protected function get_instance_hash_key( $serialized_instance ) {
+                return wp_hash( $serialized_instance );
         }
 
@@ -1193 +1191 @@
 
                 $decoded = base64_decode( $value['encoded_serialized_instance'], true );
-
                 if ( false === $decoded ) {
                         return null;
                 }
+
+                if ( $this->get_instance_hash_key( $decoded ) !== $value['instance_hash_key'] ) {
+                        return null;
+                }
+
                 $instance = unserialize( $decoded );
-
                 if ( false === $instance ) {
                         return null;
                 }
-                if ( $this->get_instance_hash_key( $instance ) !== $value['instance_hash_key'] ) {
-                        return null;
-                }
+
                 return $instance;
         }
@@ -1225 +1224 @@
                                 'title'                         => empty( $value['title'] ) ? '' : $value['title'],
                                 'is_widget_customizer_js_value' => true,
-                                'instance_hash_key'             => $this->get_instance_hash_key( $value ),
+                                'instance_hash_key'             => $this->get_instance_hash_key( $serialized ),
                         );
                 }