Changeset 56003

Timestamp:

06/23/2023 04:01:08 PM (3 years ago)

Author:

swissspidy

Message:

I18N: Ensure determine_locale() does not potentially return an empty string.

Call get_locale() as a last resort in case the sanitized locale is an empty string.

Also swaps conditionals to cater for more typical use case and adds tests.

Follow-up to [55862]

Props Cybr, swissspidy.
Fixes #58317.

Location:

trunk

Files:

• src/wp-includes/l10n.php (modified) (1 diff)
• tests/phpunit/tests/l10n/determineLocale.php (modified) (1 diff)

trunk/src/wp-includes/l10n.php

@@ -146 +146 @@
                         $determined_locale = sanitize_locale_name( $_COOKIE['wp_lang'] );
                 }
-        } else if (
-                ( isset( $_GET['_locale'] ) && 'user' === $_GET['_locale'] && wp_is_json_request() ) ||
-                is_admin()
+        } elseif (
+                is_admin() ||
+                ( isset( $_GET['_locale'] ) && 'user' === $_GET['_locale'] && wp_is_json_request() )
         ) {
                 $determined_locale = get_user_locale();
-        } else {
+        }
+
+        if ( ! $determined_locale ) {
                 $determined_locale = get_locale();
         }

trunk/tests/phpunit/tests/l10n/determineLocale.php

@@ -212 +212 @@
         }
 
+        public function test_wp_login_get_param_on_login_page_incorrect_string() {
+                add_filter(
+                        'locale',
+                        static function() {
+                                return 'siteLocale';
+                        }
+                );
+
+                wp_set_current_user( self::$user_id );
+
+                $GLOBALS['pagenow'] = 'wp-login.php';
+                $_GET['wp_lang']    = '###'; // Something sanitize_locale_name() strips away.
+
+                $this->assertSame( 'siteLocale', determine_locale() );
+        }
+
         public function test_wp_login_cookie_not_on_login_page() {
                 add_filter(