From 2a039d481e368d9d9c17008f4ed485c1d82b4715 Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Mon, 17 Jun 2019 18:36:28 +0000 Subject: [PATCH] Bootstrap/Load: Return a 403 error code when the recovery mode cookie is invalid or expired, or the exit recovery mode nonce check failed. Props david.binda, spacedmonkey. Fixes #47479. git-svn-id: https://develop.svn.wordpress.org/trunk@45544 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/class-wp-recovery-mode.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/wp-includes/class-wp-recovery-mode.php b/src/wp-includes/class-wp-recovery-mode.php index 31d33d38fe..608864d6ee 100644 --- a/src/wp-includes/class-wp-recovery-mode.php +++ b/src/wp-includes/class-wp-recovery-mode.php @@ -239,7 +239,7 @@ class WP_Recovery_Mode { } if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( $_GET['_wpnonce'], self::EXIT_ACTION ) ) { - wp_die( __( 'Exit recovery mode link expired.' ) ); + wp_die( __( 'Exit recovery mode link expired.' ), 403 ); } if ( ! $this->exit_recovery_mode() ) { @@ -272,14 +272,16 @@ class WP_Recovery_Mode { if ( is_wp_error( $validated ) ) { $this->cookie_service->clear_cookie(); - wp_die( $validated, '' ); + $validated->add_data( array( 'status' => 403 ) ); + wp_die( $validated ); } $session_id = $this->cookie_service->get_session_id_from_cookie(); if ( is_wp_error( $session_id ) ) { $this->cookie_service->clear_cookie(); - wp_die( $session_id, '' ); + $session_id->add_data( array( 'status' => 403 ) ); + wp_die( $session_id ); } $this->is_active = true;