Changeset 44073 for branches/3.8/src/wp-includes/class-wp.php

Timestamp:

12/13/2018 02:00:21 AM (7 years ago)

Author:

peterwilsoncc

Message:

Multisite: Validate activation links.

Merges [44048] to the 3.8 branch.

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp.php (modified) (1 diff)

branches/3.8/src/wp-includes/class-wp.php

@@ -266 +266 @@
             if ( isset( $this->extra_query_vars[$wpvar] ) )
                 $this->query_vars[$wpvar] = $this->extra_query_vars[$wpvar];
+            elseif ( isset( $_GET[ $wpvar ] ) && isset( $_POST[ $wpvar ] ) && $_GET[ $wpvar ] !== $_POST[ $wpvar ] )
+                wp_die( __( 'A variable mismatch has been detected.' ), __( 'Sorry, you are not allowed to view this item.' ), 400 );
             elseif ( isset( $_POST[$wpvar] ) )
                 $this->query_vars[$wpvar] = $_POST[$wpvar];