Changeset 50677

Timestamp:

04/06/2021 06:37:06 PM (4 years ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Check if $_GET['login'] is set before using it in wp-login.php.

This avoids an "Undefined index" PHP notice displayed as part of password reset process if $_GET['key'] is set, but $_GET['login'] is not.

Props satrancali.
Fixes #52980.

File:

• trunk/src/wp-login.php (modified) (1 diff)

trunk/src/wp-login.php

@@ -808 +808 @@
         $rp_cookie       = 'wp-resetpass-' . COOKIEHASH;
 
-        if ( isset( $_GET['key'] ) ) {
+        if ( isset( $_GET['key'] ) && isset( $_GET['login'] ) ) {
             $value = sprintf( '%s:%s', wp_unslash( $_GET['login'] ), wp_unslash( $_GET['key'] ) );
             setcookie( $rp_cookie, $value, 0, $rp_path, COOKIE_DOMAIN, is_ssl(), true );