Changeset 44061 for branches/4.4/src/wp-includes/class-wp.php

Timestamp:

12/13/2018 01:46:24 AM (6 years ago)

Author:

peterwilsoncc

Message:

Multisite: Validate activation links.

Merges [44048] to the 4.4 branch.

Location:

branches/4.4

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp.php (modified) (1 diff)

branches/4.4/src/wp-includes/class-wp.php

@@ -279 +279 @@
             if ( isset( $this->extra_query_vars[$wpvar] ) )
                 $this->query_vars[$wpvar] = $this->extra_query_vars[$wpvar];
+            elseif ( isset( $_GET[ $wpvar ] ) && isset( $_POST[ $wpvar ] ) && $_GET[ $wpvar ] !== $_POST[ $wpvar ] )
+                wp_die( __( 'A variable mismatch has been detected.' ), __( 'Sorry, you are not allowed to view this item.' ), 400 );
             elseif ( isset( $_POST[$wpvar] ) )
                 $this->query_vars[$wpvar] = $_POST[$wpvar];