WordPress-C/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2025-02-23 06:55:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Correctly set the secure flag on the post password cookie based on the scheme of the referring URL, if it's available, instead of the home URL.

Browse Source 
Fixes #29641

Built from https://develop.svn.wordpress.org/trunk@34932


git-svn-id: http://core.svn.wordpress.org/trunk@34897 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
John Blackbourn 2015-10-08 03:09:24 +00:00
parent 95045d629b
commit d2416ca93a
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '4.4-alpha-34931';
$wp_version = '4.4-alpha-34932';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

7
wp-login.php
View File

@ -440,7 +440,12 @@ case 'postpass' :
* @param int $expires The expiry time, as passed to setcookie().
*/
$expire = apply_filters( 'post_password_expires', time() + 10 * DAY_IN_SECONDS );
$secure = ( 'https' === parse_url( home_url(), PHP_URL_SCHEME ) );
$referer = wp_get_referer();
if ( $referer ) {
$secure = ( 'https' === parse_url( $referer, PHP_URL_SCHEME ) );
} else {
$secure = false;
}
setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure );
wp_safe_redirect( wp_get_referer() );