PHP notice on login page (without login)

[satrancali]

​https://www.example.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1&key=zwrtxqvag3j2tmusofaaa&hinri7j2=1

Steps

1- you just enter the admin login page
2- ​https://www.example.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1
3- You add the this parameter " &key=zwrtxqvag3j2 "
4- page will show you directory of website

If it is a bug, I want to just add my name your website thank you page, my name is " Ali Kaan BAŞHAN "

[SergeyBiryukov]

Hi there, welcome to WordPress Trac! Thanks for the report.

Just to clarify, path disclosure is considered a ​server configuration issue in WordPress, and not a security issue.

We should fix the PHP notice, though. This is not new in 5.7 and appears to be originally introduced in [11801] and further adjusted in [15710] and [29327], changing the Version field accordingly.

[SergeyBiryukov]

In 50677:

Login and Registration: Check if $_GET['login'] is set before using it in wp-login.php.

This avoids an "Undefined index" PHP notice displayed as part of password reset process if $_GET['key'] is set, but $_GET['login'] is not.

Props satrancali.
Fixes #52980.