Changeset 38421

Timestamp:

08/28/2016 05:30:29 PM (8 years ago)

Author:

johnbillion

Message:

Security: Return a 403 instead of a 200 HTTP status when check_ajax_referer() fails.

This is, unfortunately, untestable in the current test suite, even in the AJAX tests.

Fixes #36362

Location:

trunk/src/wp-includes

Files:

• functions.php (modified) (1 diff)
• pluggable.php (modified) (1 diff)

trunk/src/wp-includes/functions.php

@@ -2862 +2862 @@
  * @access private
  *
- * @param string $message Optional. Response to print. Default empty.
- */
-function _ajax_wp_die_handler( $message = '' ) {
+ * @param string       $message Error message. 
+ * @param string       $title   Optional. Error title (unused). Default empty. 
+ * @param string|array $args    Optional. Arguments to control behavior. Default empty array. 
+ */ 
+function _ajax_wp_die_handler( $message, $title = '', $args = array() ) { 
+    $defaults = array( 
+        'response' => 200, 
+    ); 
+    $r = wp_parse_args( $args, $defaults ); 
+
+    if ( ! headers_sent() ) { 
+        status_header( $r['response'] ); 
+    }
     if ( is_scalar( $message ) )
         die( (string) $message );

trunk/src/wp-includes/pluggable.php

@@ -1109 +1109 @@
     if ( $die && false === $result ) {
         if ( wp_doing_ajax() ) {
-            wp_die( -1 );
+            wp_die( -1, 403 );
         } else {
             die( '-1' );