WordPress.org
Get WordPress

Make WordPress Core

Opened 17 years ago

Closed 16 years ago

#10415 closed defect (bug) (fixed)

URL not secured in wp-trackback.php

Reported by: McGurk Owned by:
Priority: normal Milestone: 3.0.2
Component: Pings/Trackbacks Version:
Severity: normal Keywords:
Cc: Focuses:

Description

I've found that the variable $tb_url is never escaped before it's inserted into the database. I think a $wpdb->escape is needed.

Change History (4)

#1 @McGurk
17 years ago

  • Cc smartajonte@… added

#2 @azaozz
17 years ago

  • Milestone Unassigned
  • Resolution → invalid
  • Status new → closed
  • Version 2.8.1

It's escaped properly, $wpdb->prepare() escapes it.

#3 @nacin
16 years ago

  • Resolution invalid
  • Status closed → reopened

#4 @nacin
16 years ago

  • Milestone → 3.0.2
  • Resolution → fixed
  • Status reopened → closed

[16624] [16625]

Note: See TracTickets for help on using tickets.