Context Navigation

{31} Tickets in the Security component (57 matches)

Max items per page

Arguments


COMPONENT

Create a new ticket

Active tickets in the Security component
Grouped by workflow and sorted by type, summary
Accepted tickets have an '*' appended to their owner's name

Candidates for Closure (7 matches)

Ticket	Summary	Owner	Priority	Severity	Milestone	Type	Workflow	Modified
#62202	allow plugin versions to be flagged as security updates		normal	normal	Awaiting Review	feature request	close	21 months ago
#63727	A new function to sanitize an array		normal	normal	Awaiting Review	enhancement	dev-feedback	12 months ago
#37757	Add `allowed_classes` to `maybe_unserialize` When WordPress is running on PHP 7+		normal	normal	Awaiting Review	enhancement	dev-feedback	15 months ago
#62949	HttpOnly flag for the post password cookie		normal	normal	Awaiting Review	enhancement	dev-feedback	17 months ago
#61706	Support for storing and getting encrypted options		normal	normal	Awaiting Review	enhancement	dev-feedback	17 months ago
#63457	WordPress 6.8 will fail creating bcrypt when entropy sources are not available		normal	normal	Awaiting Review	defect (bug)	reporter-feedback	14 months ago
#31686	wp_authenticate_username_password() should check for a WP_Error object		normal	normal	Awaiting Review	defect (bug)	reporter-feedback	7 years ago
Slated for Next Release (2 matches)
#64969	Update bundled root certificates for 7.1		normal	normal	7.1	task (blessed)		7 weeks ago
#37000	Support for the SameSite cookie attribute		normal	normal	7.1	enhancement	dev-feedback	5 days ago
Tickets Awaiting Review (34 matches)
#41391	Links to media in password protected pages		normal	normal	Awaiting Review	defect (bug)		9 years ago
#63940	Prevent POST flood cache bypass attacks		normal	normal	Awaiting Review	defect (bug)		10 months ago
#53994	REST API requests with session cookies but an invalid/missing nonce are considered authenticated for most of the request		normal	normal	Awaiting Review	defect (bug)		5 years ago
#63259	Replace zxcvbn with zxcvbn-ts		normal	normal	Awaiting Review	defect (bug)		15 months ago
#56860	Sodium Compat library is improperly loaded		normal	normal	Awaiting Review	defect (bug)		20 months ago
#65574	Unsafe usage of href attribute in wp-admin/js/common.js		normal	normal	Awaiting Review	defect (bug)		11 days ago
#65573	Unsafe usage of href attribute in wp-admin/js/link.js		normal	normal	Awaiting Review	defect (bug)		11 days ago
#65572	Unsafe usage of href attribute in wp-admin/js/post.js		normal	normal	Awaiting Review	defect (bug)		11 days ago
#62693	check if chmod is available to prevent Fatal Errors		normal	normal	Awaiting Review	defect (bug)		19 months ago
#58679	meta key field in usermeta table should NOT use accent insensitive collations		normal	major	Awaiting Review	defect (bug)		11 months ago
#57447	wp_ajax_inline_save function does not check if post has "public" or "show_ui" enabled		normal	normal	Awaiting Review	defect (bug)		4 years ago
#62384	.htaccess lacks		normal	normal	Awaiting Review	enhancement		19 months ago
#58636	Automatic Sanitization of Nonces in wp_verify_nonce		normal	normal	Awaiting Review	enhancement		3 years ago
#40237	Educate users about modern password best-practices		normal	normal	Awaiting Review	enhancement		4 years ago
#51611	Escape echoing Core functions		normal	normal	Awaiting Review	enhancement		6 years ago
#64481	Explore Sec-Fetch Headers as a Core-Supported CSRF Mitigation Mechanism		normal	normal	Awaiting Review	enhancement		6 months ago
#43320	Harden API requests against man-in-the-middle attacks		low	minor	Awaiting Review	enhancement		8 years ago
#51159	Let's expand our context specific escaping methods for wp_json_encode().		normal	normal	Awaiting Review	enhancement		6 months ago
#57424	Specific hook for Content Security Policy		normal	normal	Awaiting Review	enhancement		4 years ago
#60470	Use `filter_input` instead of superglobals where possible		normal	normal	Awaiting Review	enhancement		2 years ago
#36177	default htaccess should include security measures		normal	normal	Awaiting Review	enhancement		19 months ago
#55514	2FA by default for WordPress		normal	normal	Awaiting Review	feature request		3 years ago
#43215	Allow wp_kses to pass allowed CSS properties		normal	normal	Awaiting Review	feature request		8 months ago
#53902	Automating the creation of inline javascript and inline stylesheet nonces or hashes		normal	normal	Awaiting Review	feature request		2 years ago
#65054	$_GET['pagenow'] and $_GET['widget'] unsanitized in dashboard AJAX handler	rajeshcp	normal	normal	Awaiting Review	defect (bug)	has-patch	11 days ago
#52333	Lack of the &colon; entity on the list of allowed entity names in kses.php		normal	minor	Awaiting Review	defect (bug)	has-patch	5 years ago
#65052	Nonce check order flaw in post-quickdraft-save	rajeshcp	normal	normal	Awaiting Review	defect (bug)	has-patch	8 weeks ago
#37264	Please do not chmod 666 the wp-config.php file on installation.		normal	normal	Awaiting Review	defect (bug)	has-patch	7 years ago
#53869	Post type / Taxonomy Label Hardening: Prevent Raw HTML tags in output / Media Library eval of HTML entities in label		normal	normal	Awaiting Review	defect (bug)	has-patch	5 years ago
#60864	URL sanitizing strips valid characters instead of encoding, documented use is invalid		normal	normal	Awaiting Review	defect (bug)	has-patch	6 months ago
#56521	wp_kses wp_kses_hair fails to allow a valueless attribute when is follwed by /		normal	major	Awaiting Review	defect (bug)	has-patch	4 years ago
#23165	Admin validation errors on form nonce element IDs (_wpnonce)		normal	normal	Awaiting Review	enhancement	has-patch	5 years ago
#63329	Use check_ajax_referer() instead of check_admin_referer() for AJAX requests in media form handling.		normal	normal	Awaiting Review	enhancement	has-patch	15 months ago
#65448	Use the new Uri\Rfc3986\Uri::parse in wp_parse_url() if PHP 8.5 is available		normal	normal	Awaiting Review	enhancement	has-patch	3 weeks ago
Tickets Needing Feedback (3 matches)
#56141	Enhance installer security		high	major	Future Release	enhancement	dev-feedback	12 days ago
#38474	wp_signups.activation_key stores activation keys in plain text	SergeyBiryukov	normal	normal	Future Release	enhancement	dev-feedback	2 weeks ago
#30465	Dashboard alert if a plugin/theme was removed from WordPress repo		normal	normal	Future Release	feature request	dev-feedback	5 months ago
Tickets with Patches (5 matches)
#51407	Remove inline event handlers and JavaScript URIs for Strict CSP-compatibility	adamsilverstein	normal	normal	Future Release	enhancement	dev-feedback	3 years ago
#20140	Ask old password to change user password		normal	major	Future Release	feature request	dev-feedback	2 days ago
#53973	WordPress <= 5.8 - Authenticated Persistent XSS (User role name)		normal	normal	Future Release	defect (bug)	has-patch	16 months ago
#56391	safecss_filter_attr(): support rgba background-color		normal	normal		defect (bug)	has-patch	5 months ago
#28521	FORCE_SSL constant for really forcing SSL	adamsilverstein	normal	normal	Future Release	enhancement	has-patch	11 days ago
Unpatched Bugs (1 match)
#62134	Security Issue in WordPress Core		normal	normal		defect (bug)		21 months ago
Unpatched Enhancements (5 matches)
#44058	Include security sniffs in PHPCS ruleset		normal	normal	Future Release	enhancement		8 years ago
#36087	Migration plan from insecure RNG fallback		normal	normal	Future Release	enhancement		6 years ago
#32067	Remove inline javascript from WP-Core to allow CSP protection		normal	normal	Future Release	feature request	close	2 months ago
#64789	Security audit for API key storage on the Connectors screen		normal	normal	Future Release	task (blessed)	dev-feedback	7 weeks ago
#51438	Use CSP directive upgrade-insecure-requests when using HTTPS		normal	normal	Future Release	enhancement	needs-unit-tests	5 years ago

Note: See TracReports for help on using and creating reports.

Make WordPress Core

Context Navigation

{31} Tickets in the Security component (57 matches)

Candidates for Closure (7 matches)

Slated for Next Release (2 matches)

Tickets Awaiting Review (34 matches)

Tickets Needing Feedback (3 matches)

Tickets with Patches (5 matches)

Unpatched Bugs (1 match)

Unpatched Enhancements (5 matches)

Download in other formats: