Changeset 63100 for branches/6.0/src/wp-login.php

Timestamp:

08/06/2026 07:38:52 PM (2 months ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 5.9 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
• Editor: Fix output for post date.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 5.9 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

File:

• branches/6.0/src/wp-login.php (modified) (2 diffs)

branches/6.0/src/wp-login.php

@@ -1120 +1120 @@
                                         /* translators: %s: Link to the login page. */
                                         __( 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.' ),
-                                        wp_login_url()
+                                        esc_url( wp_login_url() )
                                 ),
                                 'message'
@@ -1130 +1130 @@
                                         /* translators: %s: Link to the login page. */
                                         __( 'Registration complete. Please check your email, then visit the <a href="%s">login page</a>.' ),
-                                        wp_login_url()
+                                        esc_url( wp_login_url() )
                                 ),
                                 'message'