Changeset 41926 for trunk/src/wp-admin/admin-ajax.php

Timestamp:

10/18/2017 09:00:39 PM (9 years ago)

Author:

SergeyBiryukov

Message:

Administration: After [41120], check for a registered action before sending a Bad Request HTTP response status code.

Props Clorith.
Fixes #42240.

File:

• trunk/src/wp-admin/admin-ajax.php (modified) (3 diffs)

trunk/src/wp-admin/admin-ajax.php

@@ -82 +82 @@
 
 if ( is_user_logged_in() ) {
+        // If no action is registered, return a Bad Request response.
+        if ( ! has_action( 'wp_ajax_' . $_REQUEST['action'] ) ) {
+                wp_die( '0', 400 );
+        }
+
         /**
          * Fires authenticated Ajax actions for logged-in users.
@@ -92 +97 @@
         do_action( 'wp_ajax_' . $_REQUEST['action'] );
 } else {
+        // If no action is registered, return a Bad Request response.
+        if ( ! has_action( 'wp_ajax_nopriv_' . $_REQUEST['action'] ) ) {
+                wp_die( '0', 400 );
+        }
+
         /**
          * Fires non-authenticated Ajax actions for logged-out users.
@@ -103 +113 @@
 }
 // Default status
-wp_die( '0', 400 );
+wp_die( '0' );