Changeset 2890978

Timestamp:

03/31/2023 07:45:20 AM (3 years ago)

Author:

supportcandy

Message:

SQL Injection fix

File:

• supportcandy/trunk/includes/class-wpsc-current-user.php (modified) (1 diff)

supportcandy/trunk/includes/class-wpsc-current-user.php

@@ -165 +165 @@
 
             // guest login.
-            $gs         = get_option( 'wpsc-gs-general' );
+            $gs = get_option( 'wpsc-gs-general' );
+
             $login_auth = isset( $_COOKIE['wpsc_guest_login_auth'] ) ? sanitize_text_field( wp_unslash( $_COOKIE['wpsc_guest_login_auth'] ) ) : '';
             $login_auth = $login_auth ? json_decode( $login_auth ) : false;
+
+            if ( ! $login_auth ) {
+                self::$current_user = new WPSC_Current_User();
+                return;
+            }
+
+            $login_auth->email = $login_auth->email ? sanitize_email( $login_auth->email ) : '';
+            if ( ! $login_auth->email ) {
+                self::$current_user = new WPSC_Current_User();
+                return;
+            }
 
             if ( $login_auth && self::validate_guest_login( $login_auth ) ) {