![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 15 years ago
Closed 15 years ago
#18715 closed defect (bug) (wontfix)
Information disclosure issue in update.php
| Reported by: | joostdevalk | Owned by: | joostdevalk |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | Security | Version: | 3.3 |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description
/wp-includes/update.php discloses the full path of the WP install, patch to fix that attached.
Attachments (1)
Change History (2)
#1
@
15 years ago
- Milestone Awaiting Review
- Resolution → wontfix
- Status new → closed
The same occurs in most of /wp-includes/*.php and /wp-admin/includes/*.php
However, this is not a security issue, nor is it something that intends on being "fixed" as it's not encountered during "standard usage". If WordPress is used on a production server, error displays should be disabled, and/or direct access to the php files in the above directories disabled.
Note:
See TracTickets
for help on using tickets.
Patch