From fa88bbfc793989b9f4b967182f10f7512e1f123d Mon Sep 17 00:00:00 2001 From: TimothyBlynJacobs Date: Sat, 2 Jan 2021 21:35:04 +0000 Subject: [PATCH] App Passwords: Only attempt auth if the username and password are set. Previously, only the username was checked which caused a PHP warning in some server setups, for instance Shibboleth SSO, where the server only populates the `PHP_AUTH_USER` field. Props MadtownLems, johnbillion, richard.tape, engahmeds3ed. Fixes #52003. Built from https://develop.svn.wordpress.org/trunk@49919 git-svn-id: http://core.svn.wordpress.org/trunk@49618 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/user.php | 4 ++-- wp-includes/version.php | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/wp-includes/user.php b/wp-includes/user.php index b8275338c8..134258d4fe 100644 --- a/wp-includes/user.php +++ b/wp-includes/user.php @@ -462,8 +462,8 @@ function wp_validate_application_password( $input_user ) { return $input_user; } - // Check that we're trying to authenticate - if ( ! isset( $_SERVER['PHP_AUTH_USER'] ) ) { + // Both $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] must be set in order to attempt authentication. + if ( ! isset( $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] ) ) { return $input_user; } diff --git a/wp-includes/version.php b/wp-includes/version.php index 4879039944..23d8a5db6a 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.7-alpha-49918'; +$wp_version = '5.7-alpha-49919'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.