WordPress.org
Get WordPress

Make WordPress Core

Opened 14 years ago

Closed 13 years ago

#10415 closed defect (bug) (fixed)

URL not secured in wp-trackback.php

Reported by: mcgurk's profile McGurk Owned by:
Milestone: 3.0.2 Priority: normal
Severity: normal Version:
Component: Pings/Trackbacks Keywords:
Focuses: Cc:

Description

I've found that the variable $tb_url is never escaped before it's inserted into the database. I think a $wpdb->escape is needed.

Change History (4)

#1 @McGurk
14 years ago

  • Cc smartajonte@… added

#2 @azaozz
14 years ago

  • Milestone Unassigned deleted
  • Resolution set to invalid
  • Status changed from new to closed
  • Version 2.8.1 deleted

It's escaped properly, $wpdb->prepare() escapes it.

#3 @nacin
13 years ago

  • Resolution invalid deleted
  • Status changed from closed to reopened

#4 @nacin
13 years ago

  • Milestone set to 3.0.2
  • Resolution set to fixed
  • Status changed from reopened to closed

[16624] [16625]

Note: See TracTickets for help on using tickets.