WordPress.org
Get WordPress

Make WordPress Core

Opened 15 years ago

Closed 14 years ago

#11514 closed enhancement (fixed)

name and class in wp_list_categories not sanitized

Reported by: petervanderdoes's profile petervanderdoes Owned by: filosofo's profile filosofo
Milestone: 3.1 Priority: normal
Severity: major Version: 3.1
Component: Taxonomy Keywords: has-patch dev-feedback
Focuses: Cc:

Description

In wp_dropdown_categories the attributes name and class are sanitized but not in wp_list_categories.

Attachments (2)

sanitze.diff​ (407 bytes) - added by petervanderdoes 15 years ago.
Adds sanitazition of name and class
clipboard.patch​ (513 bytes) - added by hakre 14 years ago.
forgotten esc_attr

Download all attachments as: .zip

Change History (10)

@petervanderdoes
15 years ago

Adds sanitazition of name and class

#1 @hakre
15 years ago

  • Milestone changed from Unassigned to 3.0
  • Priority changed from low to normal
  • Severity changed from normal to major

Considered hardening. Considered Blocker. Even 2.8 updates consider-able. Reference: [12539]

#2 @hakre
15 years ago

  • Keywords dev-feedback added

This is actually security related and some core-devs should at least consider to take a look in this ticket. Feedback wanted.

#3 @hakre
15 years ago

Related: #9875

#4 @nacin
15 years ago

  • Milestone 3.0 deleted
  • Resolution set to invalid
  • Status changed from new to closed

We don't use either of those attributes in wp_list_categories().

@hakre
14 years ago

forgotten esc_attr

#5 @hakre
14 years ago

  • Resolution invalid deleted
  • Status changed from closed to reopened
  • Version changed from 2.9 to 3.1

Replying to nacin:

We don't use either of those attributes in wp_list_categories().

I see wp_list_categories() making use of $class in 3.1 trunk. Just attached the patch.

#6 @nacin
14 years ago

  • Milestone set to 3.1

#8 @nacin
14 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

(In [16341]) Escape the class arg in wp_list_categories. props hakre, fixes #11514.

Note: See TracTickets for help on using tickets.