User pass issue

Hello,

The user password sanitizing used in login is wrong. I had a password containing “…%ea…” in the password, and after an upgrade, it fails to log in.

In fact, this part in “profile-magic-login-form.php” remove those characteres:

// Retrieve possible errors from request parameters
$pm_sanitizer = new PM_sanitizer;
$request = $pm_sanitizer->sanitize($_REQUEST);
$post = $pm_sanitizer->sanitize($_POST);

$_POST has the correct password, $post the incorrect one.

Maybe add a new case in the sanitizer instead of failing back to the sanitize_text_field for user_pass ?

I upgraded from Version: 5.9.3.3 to Version: 5.9.4.9. The “sanitize” function seems to had undergone a big rewrite.

• This topic was modified 1 year ago by saweber.