Changeset 17260

Timestamp:

01/11/2011 09:37:12 PM (14 years ago)

Author:

nacin

Message:

Disallow a self-reference on RSS widget save, which would DoS a site. Checking home/siteurl should cover the vast majority of cases. see #8910.

File:

• trunk/wp-includes/default-widgets.php (modified) (1 diff)

trunk/wp-includes/default-widgets.php

@@ -713 +713 @@
             return;
 
+        // self-url destruction sequence
+        if ( $url == site_url() || $url == home_url() )
+            return;
+
         $rss = fetch_feed($url);
         $title = $instance['title'];