Changeset 6400 for trunk/wp-includes/pluggable.php

Timestamp:

12/17/2007 09:12:28 PM (18 years ago)

Author:

ryan

Message:

Fix AJAX cookie validation. see #5367

File:

• trunk/wp-includes/pluggable.php (modified) (2 diffs)

trunk/wp-includes/pluggable.php

@@ -434 +434 @@
     $nonce = $_REQUEST['_ajax_nonce'] ? $_REQUEST['_ajax_nonce'] : $_REQUEST['_wpnonce'];
     if ( !wp_verify_nonce( $nonce, $action ) ) {
-        $current_name = '';
+        $current_id = '';
         if ( ( $current = wp_get_current_user() ) && $current->ID )
-            $current_name = $current->user_login;
-        if ( !$current_name )
+            $current_id = $current->ID;
+        if ( !$current_id )
             die('-1');
 
@@ -447 +447 @@
         }
 
-        if ( $current_name != $user || empty($auth_cookie) || !wp_validate_auth_cookie( $auth_cookie ) )
+        if ( empty($auth_cookie) )
+            die('-1');
+
+        if ( ! $user_id = wp_validate_auth_cookie( $auth_cookie ) )
+            die('-1');
+    
+        if ( $current_id != $user_id )
             die('-1');
     }