WordPress.org

Make WordPress Core

Opened 8 months ago

Closed 8 months ago

#52980 closed defect (bug) (fixed)

PHP notice on login page (without login)

Reported by: satrancali Owned by: SergeyBiryukov
Milestone: 5.8 Priority: normal
Severity: normal Version: 2.9
Component: Login and Registration Keywords:
Focuses: Cc:

Description

https://www.example.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1&key=zwrtxqvag3j2tmusofaaa&hinri7j2=1

Steps

1- you just enter the admin login page
2- https://www.example.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.example.com%2Fwp-admin%2F&reauth=1
3- You add the this parameter " &key=zwrtxqvag3j2 "
4- page will show you directory of website

If it is a bug, I want to just add my name your website thank you page, my name is " Ali Kaan BAŞHAN "

Attachments (1)

q1.png (177.1 KB) - added by satrancali 8 months ago.

Download all attachments as: .zip

Change History (3)

@satrancali
8 months ago

#1 @SergeyBiryukov
8 months ago

  • Component changed from General to Login and Registration
  • Milestone changed from Awaiting Review to 5.8
  • Summary changed from This Bug Show Directory from admin panel login page ( without login ) to PHP notice on login page (without login)
  • Version changed from 5.7 to 2.9

Hi there, welcome to WordPress Trac! Thanks for the report.

Just to clarify, path disclosure is considered a server configuration issue in WordPress, and not a security issue.

We should fix the PHP notice, though. This is not new in 5.7 and appears to be originally introduced in [11801] and further adjusted in [15710] and [29327], changing the Version field accordingly.

#2 @SergeyBiryukov
8 months ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 50677:

Login and Registration: Check if $_GET['login'] is set before using it in wp-login.php.

This avoids an "Undefined index" PHP notice displayed as part of password reset process if $_GET['key'] is set, but $_GET['login'] is not.

Props satrancali.
Fixes #52980.

Note: See TracTickets for help on using tickets.