Changeset 41782

Timestamp:

10/06/2017 05:36:12 PM (9 years ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Prevent PHP warnings when POSTing to wp-login.php with an array as a user_login or user_email field.

Props menakas, johnjamesjacoby.
Fixes #40888.

File:

• trunk/src/wp-login.php (modified) (3 diffs)

trunk/src/wp-login.php

@@ -299 +299 @@
         $errors = new WP_Error();
 
-        if ( empty( $_POST['user_login'] ) ) {
+        if ( empty( $_POST['user_login'] ) || ! is_string( $_POST['user_login'] ) ) {
                 $errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));
         } elseif ( strpos( $_POST['user_login'], '@' ) ) {
@@ -566 +566 @@
         login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
 
-        $user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : '';
+        $user_login = '';
+
+        if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
+                $user_login = wp_unslash( $_POST['user_login'] );
+        }
 
 ?>
@@ -758 +762 @@
         $user_login = '';
         $user_email = '';
+
         if ( $http_post ) {
-                $user_login = isset( $_POST['user_login'] ) ? $_POST['user_login'] : '';
-                $user_email = isset( $_POST['user_email'] ) ? wp_unslash( $_POST['user_email'] ) : '';
+                if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
+                        $user_login = $_POST['user_login'];
+                }
+
+                if ( isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ) {
+                        $user_email = wp_unslash( $_POST['user_email'] );
+                }
+
                 $errors = register_new_user($user_login, $user_email);
                 if ( !is_wp_error($errors) ) {