| @@ -394,8 +394,9 @@ | ||
| 394 | 394 | |
| 395 | 395 | /** |
| 396 | 396 | * Retrieves a single donor from the database |
| 397 | 397 | * |
| 398 | + * @since 4.16.8.1 Reject an email lookup value that sanitize_text_field() would rewrite, instead of matching against the rewritten form. | |
| 398 | 399 | * @since 1.0 |
| 399 | 400 | * @access public |
| 400 | 401 | * |
| 401 | 402 | * @param string $field ID or email. Default is 'id'. |
| @@ -403,9 +404,10 @@ | ||
| 403 | 404 | * |
| 404 | 405 | * @return mixed Upon success, an object of the donor. Upon failure, NULL |
| 405 | 406 | */ |
| 406 | 407 | public function get_donor_by( $field = 'id', $value = 0 ) { |
| 407 | - $value = sanitize_text_field( $value ); | |
| 408 | + $submitted_value = is_string( $value ) ? trim( $value ) : $value; | |
| 409 | + $value = sanitize_text_field( $value ); | |
| 408 | 410 | |
| 409 | 411 | // Bailout. |
| 410 | 412 | if ( empty( $field ) || empty( $value ) ) { |
| 411 | 413 | return null; |
| @@ -426,8 +428,17 @@ | ||
| 426 | 428 | } |
| 427 | 429 | } elseif ( 'email' === $field ) { |
| 428 | 430 | |
| 429 | 431 | if ( ! is_email( $value ) ) { |
| 432 | + return false; | |
| 433 | + } | |
| 434 | + | |
| 435 | + // The column this looks up is unique on its raw, stored bytes. Matching | |
| 436 | + // against a form that sanitize_text_field() rewrote (e.g. by removing | |
| 437 | + // percent-hex sequences) would compare a different string than what is | |
| 438 | + // actually stored, letting one row's raw value resolve to another row's | |
| 439 | + // plain value. Require the two to already agree. | |
| 440 | + if ( $value !== $submitted_value ) { | |
| 430 | 441 | return false; |
| 431 | 442 | } |
| 432 | 443 | |
| 433 | 444 | $value = trim( $value ); |
