Changeset 46640 for trunk/src/wp-login.php

Timestamp:

11/03/2019 08:10:23 PM (5 years ago)

Author:

whyisjake

Message:

Login and Registration: Allow email logins to be more flexible.

Allows a login to have an apostorphe. Which would normally be created as a mistake, but this allows the login to happen.

Fixes #38744
Props wpkuf, desrosj, socalchristina, bibliofille, santilinwp, nsubugak, sncoker, cafenoirdesign, whyisjake.

File:

• trunk/src/wp-login.php (modified) (2 diffs)

trunk/src/wp-login.php

@@ -1033 +1033 @@
         if ( $http_post ) {
             if ( isset( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
-                $user_login = $_POST['user_login'];
+                $user_login = wp_unslash( $_POST['user_login'] );
             }
 
@@ -1151 +1151 @@
         // If the user wants SSL but the session is not SSL, force a secure cookie.
         if ( ! empty( $_POST['log'] ) && ! force_ssl_admin() ) {
-            $user_name = sanitize_user( $_POST['log'] );
+            $user_name = sanitize_user( wp_unslash( $_POST['log'] ) );
             $user      = get_user_by( 'login', $user_name );