Changeset 59036 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

Timestamp:

09/17/2024 10:17:41 PM (3 months ago)

Author:

kadamwhite

Message:

REST API: Only check password value in query parameters while checking post permissions.

The password property which gets sent as part of a request POST body while setting a post's password should not be checked when calculating post visibility permissions.

That value in the request body is intended to update the post, not to authenticate, and may be malformed or an invalid non-string type which would cause a fatal when checking against the hashed post password value.

Query parameter ?password= values are the correct interface to check, and are also guaranteed to be strings.

Props mlf20, devansh016, antonvlasenko, TimothyBlynJacobs, kadamwhite.
Fixes #61837.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -505 +505 @@
         }
 
-        if ( $post && ! empty( $request['password'] ) ) {
+        if ( $post && ! empty( $request->get_query_params()['password'] ) ) {
             // Check post password, and return error if invalid.
-            if ( ! hash_equals( $post->post_password, $request['password'] ) ) {
+            if ( ! hash_equals( $post->post_password, $request->get_query_params()['password'] ) ) {
                 return new WP_Error(
                     'rest_post_incorrect_password',