Return error if nonce doesn't match

An invalid nonce should never reach the identity_url checking code, which allows a user to login.
diso · Jul 18, 2016 · f705e8e · f705e8e
1 parent c664ff5
commit f705e8e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/login.php b/login.php
@@ -37,6 +37,7 @@ function openid_authenticate($user) {
 
 		if ( !wp_verify_nonce($_REQUEST['_wpnonce'], 'openid_login_' . md5($identity_url)) ) {
 			$user = new WP_Error('openid_login_error', __('Error during OpenID authentication.  Please try again. (invalid nonce)', 'openid'));
+			return $user;
 		}
 
 		if ( $identity_url ) {