Make WordPress Core

Opened 13 months ago

Closed 11 months ago

Last modified 11 months ago

#58047 closed defect (bug) (fixed)

Fix non-strict comparison operator in /wp-admin/includes/schema.php line 1105

Reported by: faisalahammad's profile faisalahammad Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 6.3 Priority: normal
Severity: normal Version: 6.3
Component: Upgrade/Install Keywords: has-patch
Focuses: coding-standards Cc:

Description

The issue with the code in /wp-admin/includes/schema.php line 1105 is that the comparison operator "==" is being used to compare the response code returned by wp_remote_retrieve_response_code() with the integer value 200. This is a non-strict comparison operator, which means that it will also return true if the response code is a string "200". This can lead to unexpected behavior or security vulnerabilities.

Change History (4)

This ticket was mentioned in PR #4281 on WordPress/wordpress-develop by @faisalahammad.


13 months ago
#1

  • Keywords has-patch added; needs-patch removed

Replace the non-strict comparison operator "==" with the strict comparison operator "===" in /wp-admin/includes/schema.php line 1105 to avoid unexpected behavior or security vulnerabilities. The updated code will ensure that the response code returned by wp_remote_retrieve_response_code() is strictly compared with the integer value 200.

Trac ticket: https://core.trac.wordpress.org/ticket/58047

#2 @SergeyBiryukov
11 months ago

  • Component changed from General to Upgrade/Install
  • Milestone changed from Awaiting Review to 6.3

#3 @SergeyBiryukov
11 months ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 55866:

Coding Standards: Use strict comparison in wp-admin/includes/schema.php.

Follow-up to [12756], [12862], [12880], [13070], [14485], [17928], [18899], [41348], [43628].

Props faisalahammad, aristath, poena, afercia, SergeyBiryukov.
Fixes #58042, #58047. See #57839.

@SergeyBiryukov commented on PR #4281:


11 months ago
#4

Thanks for the PR! Merged in r55866.

Note: See TracTickets for help on using tickets.