Fatal error from wp-login.php if password is an array

[leedxw]

If "pwd" is given as an array, it will generate a 500 error due to the use of trim()

$ curl http://localhost/wp-login.php -X POST -d 'log=example&pwd[1]=example' -s -D - -o /dev/null | grep ^HTTP
HTTP/1.1 500 Internal Server Error

"PHP message: PHP Fatal error:  Uncaught TypeError: trim(): Argument #1 ($string) must be of type string, array given in /var/www/html/wp-includes/pluggable.php:602

[leedxw]

patch for user.php to check $_POSTpwd? is a string

[audrasjb]

Hello and thanks for the ticket and patch,

This is a good point and a good workaround, however the is_string conditional will fail if the value provided is an integer, for example.

[leedxw]

In this context, I don't know that the value of $_POST['pwd'], if set, can be anything except a string or an array. It should fail for anything other than a string.

[SergeyBiryukov]

Replying to audrasjb:

This is a good point and a good workaround, however the is_string conditional will fail if the value provided is an integer, for example.

That's good to note, however values passed via $_POST can only ever be a string or an array, per the ​PHP manual:

HTTP being a text protocol, most, if not all, content that comes in Superglobal arrays, like $_POST and $_GET will remain as strings. PHP will not try to convert values to a specific type. In the example below, $_GET["var1"] will contain the string "null" and $_GET["var2"], the string "123".

/index.php?var1=null&var2=123

So I think this is ready to go, I would just add a similar check for $_POST['log'] for consistency.

[SergeyBiryukov]

In 59595:

Login and Registration: Check that the $_POST values are strings in wp_signon().

This prevents a fatal error from trim() via wp_authenticate() if an array is passed instead.

Follow-up to [6643], [58093].

Props leedxw, audrasjb, SergeyBiryukov.
Fixes #62794.

[audrasjb]

Replying to SergeyBiryukov:

That's good to note, however values passed via $_POST can only ever be a string or an array, per the ​PHP manual:

Oh, you're right, it doesn't apply on this case. Thanks.