Changeset 52813 for trunk/src/wp-admin/admin-post.php

Timestamp:

03/02/2022 02:58:09 PM (3 years ago)

Author:

SergeyBiryukov

Message:

Administration: Require a valid action parameter to be set for admin-ajax.php requests.

This avoids Array to string conversion PHP notices when an array is passed as the action parameter.

Additionally, send an appropriate HTTP response status code when an invalid action is passed to admin-post.php.

Follow-up to [13175], [19738], [41120], [41926].

Props dd32.
Fixes #55212.

File:

• trunk/src/wp-admin/admin-post.php (modified) (3 diffs)

trunk/src/wp-admin/admin-post.php

@@ -30 +30 @@
 do_action( 'admin_init' );
 
-$action = empty( $_REQUEST['action'] ) ? '' : $_REQUEST['action'];
+$action = ! empty( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
+
+// Reject invalid parameters.
+if ( ! is_scalar( $action ) ) {
+    wp_die( '', 400 );
+}
 
 if ( ! is_user_logged_in() ) {
@@ -41 +46 @@
         do_action( 'admin_post_nopriv' );
     } else {
+        // If no action is registered, return a Bad Request response.
+        if ( ! has_action( "admin_post_nopriv_{$action}" ) ) {
+            wp_die( '', 400 );
+        }
+
         /**
          * Fires on a non-authenticated admin post request for the given action.
@@ -60 +70 @@
         do_action( 'admin_post' );
     } else {
+        // If no action is registered, return a Bad Request response.
+        if ( ! has_action( "admin_post_{$action}" ) ) {
+            wp_die( '', 400 );
+        }
+
         /**
          * Fires on an authenticated admin post request for the given action.