Make WordPress Core

Opened 8 years ago

Last modified 2 years ago

#11623 accepted defect (bug)

review options list and update sanitize_option()

Reported by: dd32 Owned by: dd32
Milestone: Future Release Priority: normal
Severity: normal Version: 2.9
Component: Security Keywords: needs-patch needs-unit-tests
Focuses: Cc:


A lot of options have been added since 2.0.5, and as a result, not all of them have been added to sanitize_option()

Ideally, Options which are to be (int) or absint() should have a filter applied to them here.

Attached patch is for the first option thats brought this up, 'start_of_week' which is tested to be int in some function uses, ignored elsewhere.

I've set this to security as its preventive security..

Attachments (1)

11623.diff (384 bytes) - added by dd32 8 years ago.

Download all attachments as: .zip

Change History (9)

8 years ago

#1 @hakre
8 years ago

  • Keywords dev-feedback added

You write "ideally", does that mean that a patch could reflect more options but you only but that one in from the other ticket?

#2 @nacin
8 years ago

  • Keywords has-patch dev-feedback removed

Yea, it looks like dd32 created this ticket with the idea of updating sanitize_option() with all options that should be sanitized but aren't, and he just started off with 'start_of_week' (which came out of #10397).

Looks like there are 94 options listed in schema.php and 39 options sanitized in sanitize_option(). The remaining 55 should be checked to see whether they should be sanitized as well, and I imagine we should also check the current 39 to ensure they are being sanitized properly.

#3 @nacin
8 years ago

  • Type changed from enhancement to defect (bug)

#4 @dd32
8 years ago

  • Keywords has-patch added
  • Milestone changed from 3.0 to 3.1
  • Owner changed from ryan to dd32
  • Status changed from new to accepted

#5 @nacin
8 years ago

  • Keywords early added

#6 @nacin
8 years ago

  • Keywords 3.2-early added; has-patch early removed
  • Milestone changed from Awaiting Triage to Future Release

#7 @chriscct7
4 years ago

  • Keywords needs-patch added; 3.2-early removed

#8 @chriscct7
2 years ago

  • Keywords needs-unit-tests added
Note: See TracTickets for help on using tickets.