Opened 3 years ago
Last modified 3 years ago
#58860 new defect (bug)
Potential security issue in is_super_admin
| Reported by: | Stachethemes | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Users | Version: | |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description (last modified by )
function is_super_admin( $user_id = false ) {
if ( ! $user_id ) {
$user = wp_get_current_user();
} else {
$user = get_userdata( $user_id );
}
...
}
If user is logged in as super admin and do is_super_admin(0); it will return true;
It would be best to use strict comparison:
function is_super_admin( $user_id = false ) {
if ( false === $user_id ) {
$user = wp_get_current_user();
} else {
$user = get_userdata( $user_id );
}
...
}
Attachments (1)
Change History (3)
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
Adding strict comparison for checking the user_id
Trac ticket: https://core.trac.wordpress.org/ticket/58860