Dion Hulse a579aad05b XMLRPC: Prevent authentication from occuring after a failed authentication attmept in any single XML-RPC call. ...

This hardens WordPress against a common vector which uses multiple user identifiers in a single `system.multicall` call. In the event that authentication fails, all following authentication attempts ''in that call'' will also fail.

Props dd32, johnbillion.
Fixes #34336

Built from https://develop.svn.wordpress.org/trunk@35366


git-svn-id: http://core.svn.wordpress.org/trunk@35331 1a063a9b-81f0-0310-95a4-ce76da25c4cd

2015-10-23 04:46:24 +00:00

192 KiB

Raw Blame History

View Raw