Dion Hulse 75ab50c70e XMLRPC: Prevent authentication from occuring after a failed authentication attmept in any single XML-RPC call. ...

This hardens WordPress against a common vector which uses multiple user identifiers in a single `system.multicall` call. In the event that authentication fails, all following authentication attempts ''in that call'' will also fail.

Props dd32, johnbillion.
Fixes #34336


git-svn-id: https://develop.svn.wordpress.org/trunk@35366 602fd350-edb4-49c9-b593-d223f7449a82

2015-10-23 04:45:10 +00:00

src

XMLRPC: Prevent authentication from occuring after a failed authentication attmept in any single XML-RPC call.

2015-10-23 04:45:10 +00:00

tests

XMLRPC: Prevent authentication from occuring after a failed authentication attmept in any single XML-RPC call.

2015-10-23 04:45:10 +00:00

tools/i18n

i18n tools: Use https for msgid-bugs-address URLs.

2015-07-27 19:37:13 +00:00

.editorconfig

Use HTTPS URLs for codex.wordpress.org.

2015-04-12 21:28:58 +00:00

.gitignore

Remove an IDE-specific rule in .gitignore. These should be managed in the user's ~/.gitignore_global file.

2015-10-18 00:15:23 +00:00

.jshintrc

Update grunt-contrib-jshint to 0.11.0

2015-03-06 21:07:35 +00:00

.travis.yml

Travis CI: Use a pinned version of the object cache drop-in.

2015-10-16 14:15:18 +00:00

Gruntfile.js

Replace Autoprefixer Core with Autoprefixer

2015-10-21 16:47:21 +00:00

package.json

Bump grunt-contrib-jshint to 0.11.3

2015-10-23 01:09:03 +00:00

phpunit.xml.dist

Unit Tests: add SpeedTrapListener to phpunit/includes and add the config node to phpunit.xml.dist.

2015-10-16 00:27:28 +00:00

wp-cli.yml

Introduce default wp-cli.yml for core development.

2014-04-30 21:35:18 +00:00

wp-config-sample.php

Lightly clean up and improve inline documentation in wp-config-sample.php.

2015-05-10 00:05:30 +00:00

wp-tests-config-sample.php

Update wp-tests-config-sample.php to run with WP_DEBUG by default. see #25282.

2013-09-23 16:17:59 +00:00

Description

No description provided

243 MiB

Languages

PHP 80.5%

CSS 9.4%

JavaScript 8.5%

SCSS 0.9%

HTML 0.7%