Plugin version, etc. not sanitized like description is

[Viper007Bond]

We sanitize plugin descriptions with kses, so why not the version and such?

Try this in a plugin for example:

Version: 1.0 <script type="text/javascript">alert('I haxz0red your PC!');</script>

Now of course plugin authors could just put bad JS into the plugin itself, so this isn't really a security ticket, more a "let's-do-the-same-thing-to-all-fields" ticket (either sanitize them all or none).

[markjaquith]

Agreed re: "all or nothing"

I'd go with "all," if only to stave off the inevitable "WordPress Security Bulletin: plugins can p0wn your WordPress!"

Patch it up!

[Viper007Bond]

Roger, captain!

[markjaquith]

(In [4540]) Sanitize all plugin metadata, for consistency. Props Viper007Bond. fixes #3396

[markjaquith]

Minor nitpicky note:

In the future, when using whitespace to align blocks of similar assignments (like the row of KSES calls), use spaces instead of tabs to make them line up. Many text editors can set tabs to be varying sizes, so they won't line up unless someone is using the same size tabs as you.

[Viper007Bond]

Well there is a quasi-standard, but good point. :)