WordPress.org

Make WordPress Core


Ignore:
Timestamp:
12/13/2018 01:25:03 AM (11 months ago)
Author:
peterwilsoncc
Message:

Multisite: Validate activation links.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/class-wp.php

    r42876 r44048  
    296296            if ( isset( $this->extra_query_vars[ $wpvar ] ) ) {
    297297                $this->query_vars[ $wpvar ] = $this->extra_query_vars[ $wpvar ];
     298            } elseif ( isset( $_GET[ $wpvar ] ) && isset( $_POST[ $wpvar ] ) && $_GET[ $wpvar ] !== $_POST[ $wpvar ] ) {
     299                wp_die( __( 'A variable mismatch has been detected.' ), __( 'Sorry, you are not allowed to view this item.' ), 400 );
    298300            } elseif ( isset( $_POST[ $wpvar ] ) ) {
    299301                $this->query_vars[ $wpvar ] = $_POST[ $wpvar ];
Note: See TracChangeset for help on using the changeset viewer.