Changeset 63113 for branches/4.9/src/wp-includes/user.php

Timestamp:

08/06/2026 07:56:28 PM (2 months ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 4.9 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 4.9 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell.

File:

• branches/4.9/src/wp-includes/user.php (modified) (7 diffs)

branches/4.9/src/wp-includes/user.php

@@ -170 +170 @@
                                 /* translators: %s: user name */
                                 __( '<strong>ERROR</strong>: The password you entered for the username %s is incorrect.' ),
-                                '<strong>' . $username . '</strong>'
+                                '<strong>' . esc_html( $username ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -242 +242 @@
                                 /* translators: %s: email address */
                                 __( '<strong>ERROR</strong>: The password you entered for the email address %s is incorrect.' ),
-                                '<strong>' . $email . '</strong>'
+                                '<strong>' . esc_html( $email ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -2409 +2409 @@
         $user_id = wp_create_user( $sanitized_user_login, $user_pass, $user_email );
         if ( ! $user_id || is_wp_error( $user_id ) ) {
-                $errors->add( 'registerfail', sprintf( __( '<strong>ERROR</strong>: Couldn&#8217;t register you&hellip; please contact the <a href="mailto:%s">webmaster</a> !' ), get_option( 'admin_email' ) ) );
+                $errors->add( 'registerfail', sprintf( __( '<strong>ERROR</strong>: Couldn&#8217;t register you&hellip; please contact the <a href="mailto:%s">webmaster</a> !' ), esc_attr( get_option( 'admin_email' ) ) ) );
                 return $errors;
         }
@@ -2617 +2617 @@
  * @since 3.0.0
  * @since 4.9.0 This function was moved from wp-admin/includes/ms.php so it's no longer Multisite specific.
+ * @since 7.0.3 Added the `$user_id` parameter, which is sent with the `personal_options_update` action.
+ *
+ * @param int $user_id Optional. The ID of the user whose email is being changed. Defaults to `$_POST['user_id']` if set, otherwise 0.
  *
  * @global WP_Error $errors WP_Error object.
  * @global wpdb     $wpdb   WordPress database object.
  */
-function send_confirmation_on_profile_email() {
+function send_confirmation_on_profile_email( $user_id = 0 ) {
         global $errors, $wpdb;
+
+        // Maintain backward compatibility for those relying on a check based on $_POST['user_id'].
+        if ( ! $user_id && isset( $_POST['user_id'] ) ) {
+                $user_id = (int) $_POST['user_id'];
+        }
 
         $current_user = wp_get_current_user();
@@ -2629 +2637 @@
         }
 
-        if ( $current_user->ID != $_POST['user_id'] ) {
+        if ( 0 === $current_user->ID || $current_user->ID !== (int) $user_id ) {
                 return false;
         }
@@ -2639 +2647 @@
                         ) );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }
@@ -2648 +2657 @@
                         delete_user_meta( $current_user->ID, '_new_email' );
 
+                        $_POST['email'] = addslashes( $current_user->user_email );
                         return;
                 }