Changeset 60240 for trunk/src/wp-includes/user.php

Timestamp:

05/17/2025 01:29:20 PM (10 months ago)

Author:

SergeyBiryukov

Message:

Login and Registration: Check that $_POST value is a string in retrieve_password().

This prevents a fatal error from trim() if an array is passed instead.

Follow-up to [6643], [19056], [41782], [50129], [50140], [59595].

Props leedxw, dilipbheda, mukesh27, SergeyBiryukov.
Fixes #63433.

File:

• trunk/src/wp-includes/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -3173 +3173 @@
 
     // Use the passed $user_login if available, otherwise use $_POST['user_login'].
-    if ( ! $user_login && ! empty( $_POST['user_login'] ) ) {
+    if ( ! $user_login && ! empty( $_POST['user_login'] ) && is_string( $_POST['user_login'] ) ) {
         $user_login = $_POST['user_login'];
     }