XSS on page-new.php

[xknown]

Someone posted on ​sla.cker.org forums a new XSS vulnerability that affects all versions, including the trunk.

[xknown]

Cast to int page id

[xknown]

The given PoC is:
​http://wp/wp-admin/page-new.php?saved="><script>alert(123)</script>

PS. The patch is only for the trunk

[ryan]

(In [5078]) Cast to int. Props xknown. fixes #4012 for trunk.

[ryan]

(In [5079]) Cast to int. Props xknown. fixes #4012 for 2.1

[charleshooper]

Not to step on any toes as I understand this is a high priority item, however is casting to int adequate? I'm referring to the fact that wp_posts.ID is a BIGINT-sized column and the maximum size integer on 32-bit systems is 2,147,483,647. Not that I think many people out there have over 2 billion posts, but I feel that if we impose a limit (by casting a variable to int) then we should update the schema accordingly. Think of it as a SQL optimization if you must.

[charleshooper]

I just took a look at the schema and also noticed that other tables create their relative post_ID fields as INT(11), I'll close this again and open another ticket as they are separate issues.

[ryan]

Reopening for 2.0 inclusion.

[ryan]

(In [5080]) Cast to int. Props xknown. fixes #4012 for 2.0