From 35cdc9903914a81ca448301dd8df3a01e4396c7b Mon Sep 17 00:00:00 2001
From: Felix Arntz <felix-arntz@leaves-and-love.net>
Date: Fri, 13 Apr 2018 15:30:20 +0000
Subject: [PATCH] Multisite: Verify the signup nonce using `wp_verify_nonce()`
 in `signup_nonce_check()`.

Prior to this change, the nonce passed from `wp-signup.php` was verified with a simple comparison. Furthermore in case of failures, `wp_die()` would be called right during the HTML markup being already printed. Now the error message is returned properly, modifying the `WP_Error` object in the passed `$result`.

Props herregroen.
Fixes #43667.

Built from https://develop.svn.wordpress.org/trunk@42976


git-svn-id: http://core.svn.wordpress.org/trunk@42805 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/ms-functions.php | 4 ++--
 wp-includes/version.php      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/wp-includes/ms-functions.php b/wp-includes/ms-functions.php
index ebc699436d..f2dbbc750f 100644
--- a/wp-includes/ms-functions.php
+++ b/wp-includes/ms-functions.php
@@ -2193,8 +2193,8 @@ function signup_nonce_check( $result ) {
 		return $result;
 	}
 
-	if ( wp_create_nonce( 'signup_form_' . $_POST['signup_form_id'] ) != $_POST['_signup_form'] ) {
-		wp_die( __( 'Please try again.' ) );
+	if ( ! wp_verify_nonce( $_POST['_signup_form'], 'signup_form_' . $_POST['signup_form_id'] ) ) {
+		$result['errors']->add( 'invalid_nonce', __( 'Unable to submit this form, please try again.' ) );
 	}
 
 	return $result;
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 145daf2a67..0174704beb 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.0-alpha-42975';
+$wp_version = '5.0-alpha-42976';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.