Changeset 58093

Timestamp:

05/03/2024 02:30:56 PM (9 months ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Check that post_password is a string in wp-login.php.

This prevents a fatal error if an array is passed instead.

Follow-up to [19925], [34909], [58023].

Props dd32, swissspidy.
Fixes #61136.

File:

• trunk/src/wp-login.php (modified) (1 diff)

trunk/src/wp-login.php

@@ -754 +754 @@
 
     case 'postpass':
-        if ( ! array_key_exists( 'post_password', $_POST ) ) {
+        if ( ! isset( $_POST['post_password'] ) || ! is_string( $_POST['post_password'] ) ) {
             wp_safe_redirect( wp_get_referer() );
             exit;