Strange POST request: /?q=userpassword&namepost_render[…]

  • DreamOn11

    (@dreamon11)


    5 years, 6 months ago

    Hello,

    For a few days, my WordPress site receives this PHP Warning:

    trim() expects parameter 1 to be string, array given in /wp/wp-includes/class-wp-query.php on line 777

    From this strange POST request:

    POST /?q=user%2Fpassword&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23markup%5D=id&name%5B%23type%5D=markup

    Backtrace:

    #0 (): App\{closure}(2, 'trim() expects parameter 1 to be string, array given', '/wp/wp-includes/class-wp-query.php', '777', Array)
#1 /wp/wp-includes/class-wp-query.php(777): trim(Array)
#2 /wp/wp-includes/class-wp-query.php(1755): parse_query()
#3 /wp/wp-includes/class-wp-query.php(3432): get_posts()
#4 /wp/wp-includes/class-wp.php(624): query(Array)
#5 /wp/wp-includes/class-wp.php(741): query_posts()
#6 /wp/wp-includes/functions.php(1274): main('')
#7 /wp/wp-blog-header.php(16): wp()
#8 /index.php(5): require('/wp/wp-blog-header.php')

    I try to send the same POST request and effectively, WordPress responds.

    Is this normal behavior?

    Why WordPress responds to this request without any auth?

    Thanks.

    • This topic was modified 5 years, 6 months ago by DreamOn11.
Viewing 1 replies (of 1 total)
  • Moderator bcworkz

    (@bcworkz)

    5 years, 5 months ago

    Sorry for the slow reply. WP ignores parameters it doesn’t understand, so a response for almost any request will result. Your WP’s response should be public information, nothing sensitive, so no authorization is needed. The user/password bit in the request doesn’t mean anything to WP. The PHP warning is because one of the parameters (“name”) looks like something WP is expecting, but WP is not expecting it in array form (the %5B%5D bits define an array).

Viewing 1 replies (of 1 total)

The topic ‘Strange POST request: /?q=userpassword&namepost_render[…]’ is closed to new replies.