[wp-trac] [WordPress Trac] #34336: Disable XML-RPC system.multicall authenticated requests on the first auth failure

[WordPress Trac]

#34336: Disable XML-RPC system.multicall authenticated requests on the first auth
failure
--------------------------------------+---------------------
 Reporter:  dd32                      |       Owner:  dd32
     Type:  defect (bug)              |      Status:  closed
 Priority:  normal                    |   Milestone:  4.4
Component:  XML-RPC                   |     Version:
 Severity:  normal                    |  Resolution:  fixed
 Keywords:  has-patch has-unit-tests  |     Focuses:
--------------------------------------+---------------------
Changes (by dd32):

 * owner:   => dd32
 * status:  new => closed
 * resolution:   => fixed


Comment:

 In [changeset:"35366"]:
 {{{
 #!CommitTicketReference repository="" revision="35366"
 XMLRPC: Prevent authentication from occuring after a failed authentication
 attmept in any single XML-RPC call.

 This hardens WordPress against a common vector which uses multiple user
 identifiers in a single `system.multicall` call. In the event that
 authentication fails, all following authentication attempts ''in that
 call'' will also fail.

 Props dd32, johnbillion.
 Fixes #34336
 }}}

--
Ticket URL: <https://core.trac.wordpress.org/ticket/34336#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform