Changeset 34034 for trunk/src/wp-admin/includes/user.php

Timestamp:

09/11/2015 02:24:03 AM (10 years ago)

Author:

boonebgorges

Message:

Require numeric IDs in user deletion functions.

wp_delete_user() and wpmu_delete_user() both require an $id parameter.
Previously, the functions did not verify that the value passed was, in fact,
a number. As such, passing an object or any other entity that would be cast
to int 1 would result in user 1 being deleted. We fix this by enforcing
the requirement that $id be numeric.

Props dipesh.kakadiya, utkarshpatel, juliobox.
Fixes #33800.

File:

• trunk/src/wp-admin/includes/user.php (modified) (1 diff)

trunk/src/wp-admin/includes/user.php

@@ -273 +273 @@
 function wp_delete_user( $id, $reassign = null ) {
     global $wpdb;
+
+    if ( ! is_numeric( $id ) ) {
+        return false;
+    }
 
     $id = (int) $id;