Make WordPress Core

Opened 9 years ago

Closed 8 years ago

#3095 closed defect (bug) (fixed)

Can't escape characters for date format in Options > General

Reported by: pandem Owned by: mdawaffe
Milestone: 2.3 Priority: low
Severity: minor Version: 2.1
Component: Administration Keywords:
Focuses: Cc:


Backslashes are stripped; adding a second backslash to escape the first one only makes it visible.

Attachments (2)

3095.diff (2.5 KB) - added by mdawaffe 9 years ago.
3095b.diff (2.6 KB) - added by mdawaffe 9 years ago.

Download all attachments as: .zip

Change History (8)

@mdawaffe9 years ago

comment:1 @mdawaffe9 years ago

  • Milestone set to 2.1
  • Owner changed from anonymous to mdawaffe
  • Status changed from new to assigned

wp_kses_filters() stripslashes then addslashes, so we shouldn't stripslash stuff before it goes in.

3095.diff for trunk:

  1. Moves stripslashes() to sanitize_option() cases that need them.
  2. strip_tags() seems to do its job even without having first stripslashed. Can someone confirm for the sake of security?

I did not create a patch for 2.0.5. I can if this is deemed secure.

@mdawaffe9 years ago


comment:2 @markjaquith9 years ago


mdawaffe and I tried to break this, but couldn't.

Would appreciate special attention here, as this sort of thing has security implications if not done right. Will leave the ticket open and refrain from porting this to /branches/2.0/ until we're sure it's secure.

comment:3 @mdawaffe9 years ago

It should be fine. I think strip_tags() is in there only for efficiency. Even if someone can get around strip_tags() via some crazy slashing (which I don't *think* is possible), kses should get them.

But I'm with markjaquith: more eyes.

comment:4 @matt9 years ago

  • Milestone changed from 2.1 to 2.2

comment:5 @rob1n9 years ago

  • Milestone changed from 2.2 to 2.3

comment:6 @Nazgul8 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

I think this has been in trunk long enough to mark it as fixed.

Note: See TracTickets for help on using tickets.