Changeset 41782 for trunk/src/wp-login.php

Timestamp:

10/06/2017 05:36:12 PM (7 years ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Prevent PHP warnings when POSTing to wp-login.php with an array as a user_login or user_email field.

Props menakas, johnjamesjacoby.
Fixes #40888.

File:

• trunk/src/wp-login.php (modified) (3 diffs)

trunk/src/wp-login.php

@@ -299 +299 @@
     $errors = new WP_Error();
 
-    if ( empty( $_POST['user_login'] ) ) {
+    if ( empty( $_POST['user_login'] ) || ! is_string( $_POST['user_login'] ) ) {
         $errors->add('empty_username', __('<strong>ERROR</strong>: Enter a username or email address.'));
     } elseif ( strpos( $_POST['user_login'], '@' ) ) {
@@ -566 +566 @@
     login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
 
-    $user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : '';
+    $user_login = '';
+
+    if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
+        $user_login = wp_unslash( $_POST['user_login'] );
+    }
 
 ?>
@@ -758 +762 @@
     $user_login = '';
     $user_email = '';
+
     if ( $http_post ) {
-        $user_login = isset( $_POST['user_login'] ) ? $_POST['user_login'] : '';
-        $user_email = isset( $_POST['user_email'] ) ? wp_unslash( $_POST['user_email'] ) : '';
+        if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
+            $user_login = $_POST['user_login'];
+        }
+
+        if ( isset( $_POST['user_email'] ) && is_string( $_POST['user_email'] ) ) {
+            $user_email = wp_unslash( $_POST['user_email'] );
+        }
+
         $errors = register_new_user($user_login, $user_email);
         if ( !is_wp_error($errors) ) {