Opened 4 years ago
Closed 4 years ago
#9656 closed defect (bug) (worksforme)
Add missing filters for values in edit-link-category-form.php
| Reported by: |
|
Owned by: |
|
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | Security | Version: | 2.8 |
| Severity: | major | Keywords: | has-patch tested commit |
| Cc: |
Description
Add missing filters ("attribute_escape" and "wp_specialchars") for values in edit-link-category-form.php
Attachments (3)
Change History (18)
comment:2
hakre
— 4 years ago
- Type changed from enhancement to defect (bug)
unsufficent attribute value escapes are a defect, not an enhancement.
comment:3
Denis-de-Bernardy
— 4 years ago
- Component changed from General to Security
- Owner changed from anonymous to ryan
comment:6
Denis-de-Bernardy
— 4 years ago
- Keywords needs-patch added; has-patch removed
broken patch
comment:7
hakre
— 4 years ago
Repaired the patch. Partially this was already fixed in head because of the attr() run by ryan. looks like textareas are missing, I've chosen simeks variant using wp_specialchars() for textarea content.
comment:9
Denis-de-Bernardy
— 4 years ago
for textareas, wp has the format_to_edit() sanitizer.
comment:10
Denis-de-Bernardy
— 4 years ago
- Keywords tested commit added; security removed
- Severity changed from normal to major
this one is major
comment:11
Denis-de-Bernardy
— 4 years ago
updated patch does the same for tag description and user description.
comment:12
ryan
— 4 years ago
get_term_to_edit() should take care of the tag description.
comment:13
ryan
— 4 years ago
get_user_to_edit() could stand to call format_to_edit() instead of wp_specialchars().
comment:14
ryan
— 4 years ago
Some of the attribute escapes that got added are unnecessary since the *_to_edit() functions should take care of that.
comment:15
Denis-de-Bernardy
— 4 years ago
- Milestone 2.8 deleted
- Resolution set to worksforme
- Status changed from new to closed
oh right. after double checking, all three cases are processed already. sorry about that.
is wp_specialchars() suitable within a textarea? (guess yes but I do not properly know).
is the 'editable_slug' filter applicable to be used for category slugs?
if both questions can be answered with yes I think this patch looks good. especially the attribute_escape call is important to prevent injection issues.