| @@ -507,9 +507,9 @@ | ||
| 507 | 507 | * |
| 508 | 508 | * @return array|void |
| 509 | 509 | * @throws Exception If something goes wrong. |
| 510 | 510 | */ |
| 511 | - public function verify_response( bool $will_return = false, WP_User $expected_user = null ) { | |
| 511 | + public function verify_response( bool $will_return = false, ?WP_User $expected_user = null ) { | |
| 512 | 512 | $client_id = null; |
| 513 | 513 | try { |
| 514 | 514 | if ( ! $this->verify_nonce( 'wpdef_webauthn', 'post' ) ) { |
| 515 | 515 | throw new Exception( esc_html__( 'Bad nonce.', 'defender-security' ) ); |
| @@ -541,9 +541,9 @@ | ||
| 541 | 541 | throw new Exception( esc_html__( 'Invalid response data.', 'defender-security' ) ); |
| 542 | 542 | } |
| 543 | 543 | |
| 544 | 544 | $decoded_response = json_decode( $response_data, true ); |
| 545 | - if ( ! is_array( $decoded_response ) || empty( $decoded_response['rawId'] ) ) { | |
| 545 | + if ( ! is_array( $decoded_response ) || ! isset( $decoded_response['rawId'] ) || ! is_string( $decoded_response['rawId'] ) || '' === $decoded_response['rawId'] ) { | |
| 546 | 546 | throw new Exception( esc_html__( 'Invalid assertion payload.', 'defender-security' ) ); |
| 547 | 547 | } |
| 548 | 548 | |
| 549 | 549 | $credential_id = $this->base64url_decode( $decoded_response['rawId'] ); |
