Changeset 46498 for branches/4.4/src/wp-includes/pluggable.php

Timestamp:

10/14/2019 07:08:52 PM (6 years ago)

Author:

whyisjake

Message:

Backporting several bug fixes.

• Query: Remove the static query property.
• HTTP API: Protect against hex interpretation.
• Filesystem API: Prevent directory travelersals when creating new folders.
• Administration: Ensure that admin referer nonce is valid.
• REST API: Send a Vary: Origin header on GET requests.
• Customizer: Properly sanitize background images.

Backports [46474], [46475], [46476], [46477], [46478], [46483], [46485] to the 4.4 branch.

Location:

branches/4.4

Files:

• . (modified) (1 prop)
• src/wp-includes/pluggable.php (modified) (4 diffs)

branches/4.4/src/wp-includes/pluggable.php

@@ -1102 +1102 @@
  */
 function check_admin_referer( $action = -1, $query_arg = '_wpnonce' ) {
-    if ( -1 == $action )
-        _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2' );
+    if ( -1 === $action )
+        _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' );
 
     $adminurl = strtolower(admin_url());
@@ -1120 +1120 @@
     do_action( 'check_admin_referer', $action, $result );
 
-    if ( ! $result && ! ( -1 == $action && strpos( $referer, $adminurl ) === 0 ) ) {
+    if ( ! $result && ! ( -1 === $action && strpos( $referer, $adminurl ) === 0 ) ) {
         wp_nonce_ays( $action );
         die();
@@ -1145 +1145 @@
  */
 function check_ajax_referer( $action = -1, $query_arg = false, $die = true ) {
+    if ( -1 === $action )
+        _doing_it_wrong( __FUNCTION__, __( 'You should specify a nonce action to be verified by using the first parameter.' ), '3.2.0' );
+
     $nonce = '';
 
@@ -2494 +2497 @@
 }
 endif;
-