Changeset 52813 for trunk/src/wp-admin/admin-ajax.php

Timestamp:

03/02/2022 02:58:09 PM (3 years ago)

Author:

SergeyBiryukov

Message:

Administration: Require a valid action parameter to be set for admin-ajax.php requests.

This avoids Array to string conversion PHP notices when an array is passed as the action parameter.

Additionally, send an appropriate HTTP response status code when an invalid action is passed to admin-post.php.

Follow-up to [13175], [19738], [41120], [41926].

Props dd32.
Fixes #55212.

File:

• trunk/src/wp-admin/admin-ajax.php (modified) (3 diffs)

trunk/src/wp-admin/admin-ajax.php

@@ -28 +28 @@
 header( 'X-Robots-Tag: noindex' );
 
-// Require an action parameter.
-if ( empty( $_REQUEST['action'] ) ) {
+// Require a valid action parameter.
+if ( empty( $_REQUEST['action'] ) || ! is_scalar( $_REQUEST['action'] ) ) {
     wp_die( '0', 400 );
 }
@@ -169 +169 @@
 add_action( 'wp_ajax_nopriv_heartbeat', 'wp_ajax_nopriv_heartbeat', 1 );
 
-$action = ( isset( $_REQUEST['action'] ) ) ? $_REQUEST['action'] : '';
+$action = $_REQUEST['action'];
 
 if ( is_user_logged_in() ) {
@@ -202 +202 @@
     do_action( "wp_ajax_nopriv_{$action}" );
 }
+
 // Default status.
 wp_die( '0' );