Changeset 56003

Timestamp:

06/23/2023 04:01:08 PM (18 months ago)

Author:

swissspidy

Message:

I18N: Ensure determine_locale() does not potentially return an empty string.

Call get_locale() as a last resort in case the sanitized locale is an empty string.

Also swaps conditionals to cater for more typical use case and adds tests.

Follow-up to [55862]

Props Cybr, swissspidy.
Fixes #58317.

Location:

trunk

Files:

• src/wp-includes/l10n.php (modified) (1 diff)
• tests/phpunit/tests/l10n/determineLocale.php (modified) (1 diff)

trunk/src/wp-includes/l10n.php

@@ -146 +146 @@
             $determined_locale = sanitize_locale_name( $_COOKIE['wp_lang'] );
         }
-    } else if (
-        ( isset( $_GET['_locale'] ) && 'user' === $_GET['_locale'] && wp_is_json_request() ) ||
-        is_admin()
+    } elseif (
+        is_admin() ||
+        ( isset( $_GET['_locale'] ) && 'user' === $_GET['_locale'] && wp_is_json_request() )
     ) {
         $determined_locale = get_user_locale();
-    } else {
+    }
+
+    if ( ! $determined_locale ) {
         $determined_locale = get_locale();
     }

trunk/tests/phpunit/tests/l10n/determineLocale.php

@@ -212 +212 @@
     }
 
+    public function test_wp_login_get_param_on_login_page_incorrect_string() {
+        add_filter(
+            'locale',
+            static function() {
+                return 'siteLocale';
+            }
+        );
+
+        wp_set_current_user( self::$user_id );
+
+        $GLOBALS['pagenow'] = 'wp-login.php';
+        $_GET['wp_lang']    = '###'; // Something sanitize_locale_name() strips away.
+
+        $this->assertSame( 'siteLocale', determine_locale() );
+    }
+
     public function test_wp_login_cookie_not_on_login_page() {
         add_filter(