Changeset 50472 for branches/5.7/src/wp-includes/https-detection.php

Timestamp:

03/02/2021 03:14:09 PM (4 years ago)

Author:

SergeyBiryukov

Message:

Security, Site Health: Do not store HTTPS request error messages in an option.

This changes the logic in update_https_detection_errors() to never store error messages from the actual request since they could use a different encoding, which would make storing them in an option potentially fail, leading WordPress to then falsely assume that HTTPS is supported.

While this doesn't actually fix the encoding issue, it is not crucial to do so anyway, since these messages are not used anywhere. A simple differentiation between whether the overall HTTPS request or only the SSL verification failed should be sufficient for the purpose of this function.

Props flixos90, tmatsuur, lukecarbis.
Reviewed by flixos90, SergeyBiryukov.
Merges [50471] to the 5.7 branch.
Fixes #52484.

Location:

branches/5.7

Files:

• . (modified) (1 prop)
• src/wp-includes/https-detection.php (modified) (1 diff)

branches/5.7/src/wp-includes/https-detection.php

@@ -131 +131 @@
         if ( is_wp_error( $unverified_response ) ) {
             $support_errors->add(
-                $unverified_response->get_error_code(),
-                $unverified_response->get_error_message()
+                'https_request_failed',
+                __( 'HTTPS request failed.' )
             );
         } else {
             $support_errors->add(
                 'ssl_verification_failed',
-                $response->get_error_message()
+                __( 'SSL verification failed.' )
             );
         }