![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 8 years ago
Closed 7 years ago
#44601 closed defect (bug) (fixed)
Missing vallidations in function get_password_reset_key()
| Reported by: | edocev | Owned by: | pento |
|---|---|---|---|
| Priority: | normal | Milestone: | 5.1 |
| Component: | Users | Version: | 4.9.7 |
| Severity: | normal | Keywords: | has-patch needs-refresh |
| Cc: | Focuses: |
Description
In the get_password_reset_key() function, with parameter WP_User $user
were missing validations if the user exists, if it's set and if it's an object of the class WP_User.
Attachments (2)
Change History (6)
#2
in reply to: ↑ 1
@
8 years ago
Replying to SergeyBiryukov:
Hi @edocev, welcome to WordPress Trac! Thanks for the patch. A few notes:
- Validation should be done at the beginning of the function, otherwise it still generates a few notices if invalid data is passed.
- The
isset()check seems redundant, as$useris a required parameter. PHP already throws a warning if it's not passed.- The
empty()check is redundant as well,instanceof WP_Usershould be enough.- No need for a DocBlock here, as this piece of code is neither a hook nor a separate function.
- The error message could be a bit more clear, something like this:
if ( ! ( $user instanceof WP_User ) ) { return new WP_Error( 'invalid_user_data', __( 'Invalid user data.' ) ); }
Hello, thank you for the feedback! I've fixed the code and send the updated patch.
Note:
See TracTickets
for help on using tickets.
Hi @edocev, welcome to WordPress Trac! Thanks for the patch. A few notes:
isset()check seems redundant, as$useris a required parameter. PHP already throws a warning if it's not passed.empty()check is redundant as well,instanceof WP_Usershould be enough.if ( ! ( $user instanceof WP_User ) ) { return new WP_Error( 'invalid_user_data', __( 'Invalid user data.' ) ); }