External-Login needs to apply wp_unslash() on password before validation
-
I found an issue with this plugin with passwords containing single or double quotes or backslashes.
WordPress is using wp_slash() internally on passwords and External-Login does not use wp_unslash() before comparing or hashing passwords.
Simply adding:
$password = wp_unslash($password);
into function exlog_validate_password() in login/validate_password.php in front of the if() conditions should do just fine.Otherwise great plugin!
- The topic ‘External-Login needs to apply wp_unslash() on password before validation’ is closed to new replies.