Changeset 58023

Timestamp:

04/18/2024 06:22:19 AM (2 weeks ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Check that redirect_to is a string in wp-login.php.

This prevents a fatal error if an array is passed instead.

Follow-up to [2876], [4969], [7524], [8701], [25701], [31417], [49109].

Props TimoTijhof.
Fixes #59373.

File:

• trunk/src/wp-login.php (modified) (4 diffs)

trunk/src/wp-login.php

@@ -793 +793 @@
         wp_logout();
 
-        if ( ! empty( $_REQUEST['redirect_to'] ) ) {
+        if ( ! empty( $_REQUEST['redirect_to'] ) && is_string( $_REQUEST['redirect_to'] ) ) {
             $redirect_to           = $_REQUEST['redirect_to'];
             $requested_redirect_to = $redirect_to;
@@ -1297 +1297 @@
         }
 
-        if ( isset( $_REQUEST['redirect_to'] ) ) {
+        if ( isset( $_REQUEST['redirect_to'] ) && is_string( $_REQUEST['redirect_to'] ) ) {
             $redirect_to = $_REQUEST['redirect_to'];
             // Redirect to HTTPS if user wants SSL.
@@ -1335 +1335 @@
         }
 
-        $requested_redirect_to = isset( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
+        $requested_redirect_to = isset( $_REQUEST['redirect_to'] ) && is_string( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
+
         /**
          * Filters the login redirect URL.
@@ -1439 +1440 @@
             } elseif ( WP_Recovery_Mode_Link_Service::LOGIN_ACTION_ENTERED === $action ) {
                 $errors->add( 'enter_recovery_mode', __( 'Recovery Mode Initialized. Please log in to continue.' ), 'message' );
-            } elseif ( isset( $_GET['redirect_to'] ) && str_contains( $_GET['redirect_to'], 'wp-admin/authorize-application.php' ) ) {
+            } elseif ( isset( $_GET['redirect_to'] ) && is_string( $_GET['redirect_to'] )
+                && str_contains( $_GET['redirect_to'], 'wp-admin/authorize-application.php' )
+            ) {
                 $query_component = wp_parse_url( $_GET['redirect_to'], PHP_URL_QUERY );
                 $query           = array();