Changeset 44611 for trunk/src/wp-includes/pluggable.php

Timestamp:

01/16/2019 04:26:48 AM (6 years ago)

Author:

pento

Message:

Users: Add extra checking to wp_new_user_notification().

Prevent a notification from being sent when an unrecognised value is passed in the $notify parameter.

Props cthreelabs, 360zen.
Fixes #44293.

File:

• trunk/src/wp-includes/pluggable.php (modified) (1 diff)

trunk/src/wp-includes/pluggable.php

@@ -1895 +1895 @@
         }
 
+        // Accepts only 'user', 'admin' , 'both' or default '' as $notify
+        if ( ! in_array( $notify, array( 'user', 'admin', 'both', '' ), true ) ) {
+            return;
+        }
+
         global $wpdb, $wp_hasher;
         $user = get_userdata( $user_id );