Commit 7555dc4547 for wordpress.org

commit 7555dc45470cb8b2c3ea9e87b29da79f247c7706
Author: westonruter <westonruter@git.wordpress.org>
Date:   Thu Oct 29 19:42:14 2026 +0000

    XML-RPC: Expand test coverage for login credentials.

    The fatal error from non-scalar credentials passed to `wp.getUsersBlogs` was fixed for all authenticated methods in r63927, which rejects them in `wp_xmlrpc_server::login()`. Tests are now added at the `wp.getUsersBlogs` level, where the error was originally reported, along with `null` credential cases and a test that integer credentials, which XML-RPC clients can send as `<int>` values, still authenticate the matching user.

    The credential parameters of `wp_xmlrpc_server::login()` and `wp_xmlrpc_server::login_pass_ok()` are now documented as `mixed`, since they hold untrusted client input that `login()` validates, and are asserted to be scalar on success. This resolves static analysis errors in the methods that pass raw request arguments to `login()`. The scalar credentials are also cast to strings for `wp_authenticate()`, so `authenticate` filter callbacks now receive a string even when the client sent an integer.

    Developed in https://github.com/WordPress/wordpress-develop/pull/12462.
    Follow-up to r63006, r63927.

    Props josephscott, westonruter.
    See #66168.
    Fixes #65600.

    Built from https://develop.svn.wordpress.org/trunk@65023


    git-svn-id: http://core.svn.wordpress.org/trunk@64173 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index 9d4ee81cc6..4ac680065f 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -289,9 +289,12 @@ class wp_xmlrpc_server extends IXR_Server {
 	 * @since 2.8.0
 	 * @since 7.2.0 Returns an error if the `$username` or `$password` argument is not a scalar.
 	 *
-	 * @param string $username User's username.
-	 * @param string $password User's password.
+	 * @param mixed $username User's username.
+	 * @param mixed $password User's password.
 	 * @return WP_User|false WP_User object if authentication passed, false otherwise.
+	 *
+	 * @phpstan-assert-if-true =scalar $username
+	 * @phpstan-assert-if-true =scalar $password
 	 */
 	public function login(
 		$username,
@@ -305,8 +308,8 @@ class wp_xmlrpc_server extends IXR_Server {

 		/*
 		 * Arrays and objects sent by the client would cause a fatal error in
-		 * wp_authenticate(). Other scalar types are tolerated because PHP
-		 * coerces them to strings, which preserves backward compatibility.
+		 * wp_authenticate(). Other scalar types are tolerated and cast to
+		 * strings, which preserves backward compatibility.
 		 */
 		if ( ! is_scalar( $username ) || ! is_scalar( $password ) ) {
 			$this->error = new IXR_Error( 400, __( 'The username and password arguments should be strings.' ) );
@@ -316,7 +319,7 @@ class wp_xmlrpc_server extends IXR_Server {
 		if ( $this->auth_failed ) {
 			$user = new WP_Error( 'login_prevented' );
 		} else {
-			$user = wp_authenticate( $username, $password );
+			$user = wp_authenticate( (string) $username, (string) $password );
 		}

 		if ( is_wp_error( $user ) ) {
@@ -348,9 +351,12 @@ class wp_xmlrpc_server extends IXR_Server {
 	 * @deprecated 2.8.0 Use wp_xmlrpc_server::login()
 	 * @see wp_xmlrpc_server::login()
 	 *
-	 * @param string $username User's username.
-	 * @param string $password User's password.
+	 * @param mixed $username User's username.
+	 * @param mixed $password User's password.
 	 * @return bool Whether authentication passed.
+	 *
+	 * @phpstan-assert-if-true =scalar $username
+	 * @phpstan-assert-if-true =scalar $password
 	 */
 	public function login_pass_ok(
 		$username,
diff --git a/wp-includes/version.php b/wp-includes/version.php
index bb4a5ccd43..198a831caa 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta3-65022';
+$wp_version = '7.2-beta3-65023';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.