![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 13 years ago
Closed 13 years ago
#26077 closed defect (bug) (invalid)
check_ajax_referer $result from wp_verify_nonce should use identical comparison operator
| Reported by: | toddlahman | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | Plugins | Version: | |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description
In the check_ajax_referer() function it gets the following value:
$result = wp_verify_nonce( $nonce, $action );
The value is then tested as follows:
if ( $die && false == $result ) {
The correct test should use the identical comparison operator since wp_verify_nonce returns false if it fails to verify:
if ( $die && false === $result ) {
Change History (1)
Note:
See TracTickets
for help on using tickets.
As the core
wp_verify_nonce()only returnsfalse,1, or,2as a return value, the identical comparator isn't needed here, as it's impossible for the function to return another falsey value that would be valid.As the function is pluggable, changing this can also introduce a security issue, as a pluggable version of the function may only return falsey in the event of failure (ie.
return 0;).