Changeset 59171 for trunk/src/wp-includes/load.php

Timestamp:

10/04/2024 05:34:50 PM (2 months ago)

Author:

jorbin

Message:

Bootstrap/Load: Prevent loopback scraping errors when there is no key or nonce.

For error detection and rollback functions WordPress also starts a loopback request to the homepage. This loopback request is made with special parameters that when they don't match, generates an erorr. This hardens that flow by exiting out of the check if the nonce or key is missing or the nonce is not saved in the DB. It further hardens it by not caching the failures and asking search engines not to index the url with the failures.

Props georgwordpress, swissspidy, jorbin.
Fixes #62105.

File:

• trunk/src/wp-includes/load.php (modified) (1 diff)

trunk/src/wp-includes/load.php

@@ -1807 +1807 @@
     $key   = substr( sanitize_key( wp_unslash( $_REQUEST['wp_scrape_key'] ) ), 0, 32 );
     $nonce = wp_unslash( $_REQUEST['wp_scrape_nonce'] );
-
-    if ( get_transient( 'scrape_key_' . $key ) !== $nonce ) {
+    if ( empty( $key ) || empty( $nonce ) ) {
+        return;
+    }
+
+    $transient = get_transient( 'scrape_key_' . $key );
+    if ( false === $transient ) {
+        return;
+    }
+
+    if ( $transient !== $nonce ) {
+        if ( ! headers_sent() ) {
+            header( 'X-Robots-Tag: noindex' );
+            nocache_headers();
+        }
         echo "###### wp_scraping_result_start:$key ######";
         echo wp_json_encode(