Changeset 46477

Timestamp:

10/14/2019 03:38:14 PM (7 years ago)

Author:

whyisjake

Message:

Administration: Ensure that admin referer nonce is valid.

Coding standards, ensure that nonce is valid with identical, rather then equal operator.

Props vortfu, xknown, whyisjake.

Location:

trunk

Files:

• src/wp-includes/pluggable.php (modified) (2 diffs)
• tests/phpunit/tests/auth.php (modified) (2 diffs)

trunk/src/wp-includes/pluggable.php

@@ -1107 +1107 @@
          */
         function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
-                if ( -1 == $action ) {
+                if ( -1 === $action ) {
                         _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' );
                 }
@@ -1126 +1126 @@
                 do_action( 'check_admin_referer', $action, $result );
 
-                if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
+                if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
                         wp_nonce_ays( $action );
                         die();

trunk/tests/phpunit/tests/auth.php

@@ -25 +25 @@
                 self::$user_id = self::$_user->ID;
 
-                require_once( ABSPATH . WPINC . '/class-phpass.php' );
+                require_once ABSPATH . WPINC . '/class-phpass.php';
                 self::$wp_hasher = new PasswordHash( 8, true );
         }
@@ -166 +166 @@
         }
 
+        public function test_check_admin_referer_with_default_action_as_string_not_doing_it_wrong() {
+                $this->setExpectedIncorrectUsage( 'check_admin_referer' );
+                // A valid nonce needs to be set so the check doesn't die()
+                $_REQUEST['_wpnonce'] = wp_create_nonce( '-1' );
+                $result               = check_admin_referer( '-1' );
+                $this->assertSame( 1, $result );
+
+                unset( $_REQUEST['_wpnonce'] );
+        }
+
         /**
          * @ticket 36361