WordPress.org
Get WordPress

Make WordPress Core

Opened 17 years ago

Closed 17 years ago

#11128 closed enhancement (fixed)

QuickPress XSS fix

Reported by: Simek Owned by: ryan
Priority: normal Milestone: 2.9
Component: Security Version: 2.9
Severity: minor Keywords: has-patch tested
Cc: Focuses:

Description

QuickPress XSS fix for dashboard widget.

Attachments (1)

quickpress.title.XSS.fix.patch​ (889 bytes ) - added by Simek 17 years ago.

Download all attachments as: .zip

Change History (3)

@Simek
17 years ago

#1 @ryan
17 years ago

That's pulling a title from the DB that should already be sanitized. We should go ahead escape it anyway, but this doesn't seem to be very dangerous.

#2 @azaozz
17 years ago

  • Resolution → fixed
  • Status new → closed

(In [12235]) Escape $title in dashboard Recent Drafts to reveal HTML tags, props Simek, fixes #11128

Note: See TracTickets for help on using tickets.