Changeset 58023

Timestamp:

04/18/2024 06:22:19 AM (2 years ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Check that redirect_to is a string in wp-login.php.

This prevents a fatal error if an array is passed instead.

Follow-up to [2876], [4969], [7524], [8701], [25701], [31417], [49109].

Props TimoTijhof.
Fixes #59373.

File:

• trunk/src/wp-login.php (modified) (4 diffs)

trunk/src/wp-login.php

@@ -793 +793 @@
                 wp_logout();
 
-                if ( ! empty( $_REQUEST['redirect_to'] ) ) {
+                if ( ! empty( $_REQUEST['redirect_to'] ) && is_string( $_REQUEST['redirect_to'] ) ) {
                         $redirect_to           = $_REQUEST['redirect_to'];
                         $requested_redirect_to = $redirect_to;
@@ -1297 +1297 @@
                 }
 
-                if ( isset( $_REQUEST['redirect_to'] ) ) {
+                if ( isset( $_REQUEST['redirect_to'] ) && is_string( $_REQUEST['redirect_to'] ) ) {
                         $redirect_to = $_REQUEST['redirect_to'];
                         // Redirect to HTTPS if user wants SSL.
@@ -1335 +1335 @@
                 }
 
-                $requested_redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
+                $requested_redirect_to = isset( $_REQUEST['redirect_to'] ) && is_string( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
+
                 /**
                  * Filters the login redirect URL.
@@ -1439 +1440 @@
                         } elseif ( WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED === $action ) {
                                 $errors->add( 'enter_recovery_mode', __( 'Recovery Mode Initialized. Please log in to continue.' ), 'message' );
-                        } elseif ( isset( $_GET['redirect_to'] ) && str_contains( $_GET['redirect_to'], 'wp-admin/authorize-application.php' ) ) {
+                        } elseif ( isset( $_GET['redirect_to'] ) && is_string( $_GET['redirect_to'] )
+                                && str_contains( $_GET['redirect_to'], 'wp-admin/authorize-application.php' )
+                        ) {
                                 $query_component = wp_parse_url( $_GET['redirect_to'], PHP_URL_QUERY );
                                 $query           = array();