Changeset 44048 for trunk/src/wp-includes/class-wp.php

Timestamp:

12/13/2018 01:25:03 AM (6 years ago)

Author:

peterwilsoncc

Message:

Multisite: Validate activation links.

File:

• trunk/src/wp-includes/class-wp.php (modified) (1 diff)

trunk/src/wp-includes/class-wp.php

@@ -296 +296 @@
             if ( isset( $this->extra_query_vars[ $wpvar ] ) ) {
                 $this->query_vars[ $wpvar ] = $this->extra_query_vars[ $wpvar ];
+            } elseif ( isset( $_GET[ $wpvar ] ) && isset( $_POST[ $wpvar ] ) && $_GET[ $wpvar ] !== $_POST[ $wpvar ] ) {
+                wp_die( __( 'A variable mismatch has been detected.' ), __( 'Sorry, you are not allowed to view this item.' ), 400 );
             } elseif ( isset( $_POST[ $wpvar ] ) ) {
                 $this->query_vars[ $wpvar ] = $_POST[ $wpvar ];