Changeset 45731 for trunk/src/wp-admin/load-scripts.php

Timestamp:

08/03/2019 10:16:23 PM (6 years ago)

Author:

SergeyBiryukov

Message:

Script Loader: Send a 400 Bad Request status code in load-scripts.php and load-styles.php if the required load[] parameter is not set.

Props compilenix.
Fixes #44108.

File:

• trunk/src/wp-admin/load-scripts.php (modified) (3 diffs)

trunk/src/wp-admin/load-scripts.php

@@ -15 +15 @@
 define( 'WPINC', 'wp-includes' );
 
+$protocol = $_SERVER['SERVER_PROTOCOL'];
+if ( ! in_array( $protocol, array( 'HTTP/1.1', 'HTTP/2', 'HTTP/2.0' ) ) ) {
+    $protocol = 'HTTP/1.0';
+}
+
 $load = $_GET['load'];
 if ( is_array( $load ) ) {
@@ -25 +30 @@
 
 if ( empty( $load ) ) {
+    header( "$protocol 400 Bad Request" );
     exit;
 }
@@ -41 +47 @@
 
 if ( isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) && stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) === $wp_version ) {
-    $protocol = $_SERVER['SERVER_PROTOCOL'];
-    if ( ! in_array( $protocol, array( 'HTTP/1.1', 'HTTP/2', 'HTTP/2.0' ) ) ) {
-        $protocol = 'HTTP/1.0';
-    }
     header( "$protocol 304 Not Modified" );
     exit();