Changeset 63100 for branches/6.0/src/wp-includes/user.php

Timestamp:

08/06/2026 07:38:52 PM (7 weeks ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 5.9 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
• Editor: Fix output for post date.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 5.9 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

File:

• branches/6.0/src/wp-includes/user.php (modified) (9 diffs)

branches/6.0/src/wp-includes/user.php

@@ -153 +153 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error</strong>: The username <strong>%s</strong> is not registered on this site. If you are unsure of your username, try your email address instead.' ),
-                                $username
+                                esc_html( $username )
                         )
                 );
@@ -178 +178 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error</strong>: The password you entered for the username %s is incorrect.' ),
-                                '<strong>' . $username . '</strong>'
+                                '<strong>' . esc_html( $username ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -250 +250 @@
                                 /* translators: %s: Email address. */
                                 __( '<strong>Error</strong>: The password you entered for the email address %s is incorrect.' ),
-                                '<strong>' . $email . '</strong>'
+                                '<strong>' . esc_html( $email ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -3314 +3314 @@
                                 /* translators: %s: Link to the login page. */
                                 __( '<strong>Error:</strong> This email address is already registered. <a href="%s">Log in</a> with this address or choose another one.' ),
-                                wp_login_url()
+                                esc_url( wp_login_url() )
                         )
                 );
@@ -3362 +3362 @@
                                 /* translators: %s: Admin email address. */
                                 __( '<strong>Error</strong>: Could not register you&hellip; please contact the <a href="mailto:%s">site admin</a>!' ),
-                                get_option( 'admin_email' )
+                                esc_attr( get_option( 'admin_email' ) )
                         )
                 );
@@ -3585 +3585 @@
  * @since 3.0.0
  * @since 4.9.0 This function was moved from wp-admin/includes/ms.php so it's no longer Multisite specific.
+ * @since 7.0.3 Added the `$user_id` parameter, which is sent with the `personal_options_update` action.
+ *
+ * @param int $user_id Optional. The ID of the user whose email is being changed. Defaults to `$_POST['user_id']` if set, otherwise 0.
  *
  * @global WP_Error $errors WP_Error object.
  */
-function send_confirmation_on_profile_email() {
+function send_confirmation_on_profile_email( $user_id = 0 ) {
         global $errors;
+
+        // Maintain backward compatibility for those relying on a check based on $_POST['user_id'].
+        if ( ! $user_id && isset( $_POST['user_id'] ) ) {
+                $user_id = (int) $_POST['user_id'];
+        }
 
         $current_user = wp_get_current_user();
@@ -3596 +3604 @@
         }
 
-        if ( $current_user->ID != $_POST['user_id'] ) {
+        if ( 0 === $current_user->ID || $current_user->ID !== (int) $user_id ) {
                 return false;
         }
@@ -3610 +3618 @@
                         );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }
@@ -3623 +3632 @@
                         delete_user_meta( $current_user->ID, '_new_email' );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }