Changeset 59754 for trunk/src/wp-includes/pluggable-deprecated.php

Timestamp:

02/03/2025 07:50:50 PM (10 months ago)

Author:

johnbillion

Message:

Security: Add the SensitiveParameter attribute to sensitive parameters.

Values passed to parameters with this attribute will be redacted if present in a stack trace when using PHP 8.2 or later. This reduces the chance that passwords and security keys get accidentally exposed in debug logs and bug reports.

Props petitphp, TobiasBg, jrf, johnbillion.

Fixes #57304

File:

• trunk/src/wp-includes/pluggable-deprecated.php (modified) (2 diffs)

trunk/src/wp-includes/pluggable-deprecated.php

@@ -102 +102 @@
  * @param bool $remember Optional. Remember that the user is logged in
  */
-function wp_setcookie($username, $password = '', $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
+function wp_setcookie(
+    $username,
+    #[\SensitiveParameter]
+    $password = '',
+    $already_md5 = false,
+    $home = '',
+    $siteurl = '',
+    $remember = false
+) {
     _deprecated_function( __FUNCTION__, '2.5.0', 'wp_set_auth_cookie()' );
     $user = get_user_by('login', $username);
@@ -169 +177 @@
  * @return bool True on successful check, false on login failure.
  */
-function wp_login($username, $password, $deprecated = '') {
+function wp_login(
+    $username,
+    #[\SensitiveParameter]
+    $password,
+    $deprecated = ''
+) {
     _deprecated_function( __FUNCTION__, '2.5.0', 'wp_signon()' );
     global $error;