Changeset 38421 for trunk/src/wp-includes/pluggable.php

Timestamp:

08/28/2016 05:30:29 PM (8 years ago)

Author:

johnbillion

Message:

Security: Return a 403 instead of a 200 HTTP status when check_ajax_referer() fails.

This is, unfortunately, untestable in the current test suite, even in the AJAX tests.

Fixes #36362

File:

• trunk/src/wp-includes/pluggable.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1109 +1109 @@
     if ( $die && false === $result ) {
         if ( wp_doing_ajax() ) {
-            wp_die( -1 );
+            wp_die( -1, 403 );
         } else {
             die( '-1' );