[wp-trac] [WordPress Trac] #57670: Invalid return type for wp_get_raw_referer()

[WordPress Trac]

#57670: Invalid return type for wp_get_raw_referer()
--------------------------------------------+--------------------------
 Reporter:  xknown                          |       Owner:  johnbillion
     Type:  defect (bug)                    |      Status:  accepted
 Priority:  normal                          |   Milestone:  6.3
Component:  General                         |     Version:  4.6
 Severity:  normal                          |  Resolution:
 Keywords:  php81 has-patch has-unit-tests  |     Focuses:
--------------------------------------------+--------------------------

Comment (by xknown):

 Hi @costdev!

 > Have you reproduced this in Core's default functionality, or is it only
 when using automatic security tools?

 I didn't test it in core, but it took me less than five minutes to find an
 example:
 `'http://WP.site/wp-login.php?action=postpass&_wp_http_referer[]='`. And
 even if we can only reproduce it via security tools, I think this is
 something we need to fix.

 > What code produced the array for _wp_http_referer? (link if possible)

 It's likely somewhere in the PHP internals, but I don't think it's
 relevant for this ticket.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/57670#comment:8>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform