Make WordPress Core

Opened 9 months ago

Last modified 9 months ago

#58860 new defect (bug)

Potential security issue in is_super_admin

Reported by: stachethemes's profile Stachethemes Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Users Keywords: has-patch
Focuses: Cc:

Description (last modified by mukesh27)

function is_super_admin( $user_id = false ) {

	if ( ! $user_id ) {
		$user = wp_get_current_user();
	} else {
		$user = get_userdata( $user_id );
	}

        ...
}

If user is logged in as super admin and do is_super_admin(0); it will return true;

It would be best to use strict comparison:

function is_super_admin( $user_id = false ) {

	if ( false === $user_id ) {
		$user = wp_get_current_user();
	} else {
		$user = get_userdata( $user_id );
	}

        ...
}

Attachments (1)

58860.diff (822 bytes) - added by rajinsharwar 9 months ago.

Download all attachments as: .zip

Change History (3)

#1 @mukesh27
9 months ago

  • Component changed from Security to Users
  • Description modified (diff)
  • Version 6.2.2 deleted

This ticket was mentioned in PR #4875 on WordPress/wordpress-develop by @rajinsharwar.


9 months ago
#2

  • Keywords has-patch added

Adding strict comparison for checking the user_id

Trac ticket: https://core.trac.wordpress.org/ticket/58860

@rajinsharwar
9 months ago

Note: See TracTickets for help on using tickets.