Changeset 41926 for trunk/src/wp-admin/admin-ajax.php

Timestamp:

10/18/2017 09:00:39 PM (7 years ago)

Author:

SergeyBiryukov

Message:

Administration: After [41120], check for a registered action before sending a Bad Request HTTP response status code.

Props Clorith.
Fixes #42240.

File:

• trunk/src/wp-admin/admin-ajax.php (modified) (3 diffs)

trunk/src/wp-admin/admin-ajax.php

@@ -82 +82 @@
 
 if ( is_user_logged_in() ) {
+    // If no action is registered, return a Bad Request response.
+    if ( ! has_action( 'wp_ajax_' . $_REQUEST['action'] ) ) {
+        wp_die( '0', 400 );
+    }
+
     /**
      * Fires authenticated Ajax actions for logged-in users.
@@ -92 +97 @@
     do_action( 'wp_ajax_' . $_REQUEST['action'] );
 } else {
+    // If no action is registered, return a Bad Request response.
+    if ( ! has_action( 'wp_ajax_nopriv_' . $_REQUEST['action'] ) ) {
+        wp_die( '0', 400 );
+    }
+
     /**
      * Fires non-authenticated Ajax actions for logged-out users.
@@ -103 +113 @@
 }
 // Default status
-wp_die( '0', 400 );
+wp_die( '0' );