hash_equals throws a fatal error (hhvm) when a nonce is sent as an integer

[newleaves]

This is a follow-up to #29217.

can we add:

$nonce = (string) $nonce;

to the top of the wp_verify_nonce() function in /wp-includes/pluggable.php

[jesin]

Type cast $nonce to string. Includes unit tests.

[jesin]

Patch 29542.diff​'s unit test would error on PHP 5.6 without the type cast.

[nacin]

We can likely revert [29620/trunk/src] in the process.

[jesin]

Removes 29620, includes 29542.diff​

[jesin]

Patch 29542.2.diff​ reverts [29620/trunk/src]. Now null becomes a string "null".

I think that shouldn't be a problem.

[nacin]

(string) null is an empty string.

[ocean90]

Replying to nacin:

We can likely revert [29620/trunk/src] in the process.

Sure, it will be a string, but still empty. I think it's okay to bail earlier if nothing exists to compare against.

[ocean90]

In 30576:

Type cast $nonce to string in wp_verify_nonce().

props jesin.
fixes #29542.