WordPress.org

Make WordPress Core

Opened 7 months ago

Last modified 7 months ago

#40440 new defect (bug)

Save permalink without send form

Reported by: sebastian.pisula Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Rewrite Rules Keywords: has-patch
Focuses: Cc:

Description

if somebody open wp-admin/options-permalink.php, .htaccess are genereate and save without click submit button.

I report this bug as security issue but during send messages with John Blackbourn we have determined that this isn't a security bug so I add ticket as public.

Attachments (1)

fix.patch (657 bytes) - added by sebastian.pisula 7 months ago.

Download all attachments as: .zip

Change History (7)

#1 @sebastian.pisula
7 months ago

  • Keywords has-patch added

#2 @lukecavanagh
7 months ago

fix.patch Patch applies cleanly and does fix that issue. Confirmed on a live site that .htaccess was being written to on permalink options load and not permlink options save.

#3 follow-up: @afercia
7 months ago

I think this has always been intentional. and not an issue per se. Maybe worth discussing on the whys.

See https://codex.wordpress.org/Settings_Permalinks_Screen

Note: Visiting the Permalinks screen triggers a flush of rewrite rules. There is no need to save just to flush the rewrite rules.

#4 @lukecavanagh
7 months ago

Seems like the default should be on save, rather than on load though?

https://codex.wordpress.org/Settings_Permalinks_Screen#Save_Changes

Last edited 7 months ago by lukecavanagh (previous) (diff)

#5 @sebastian.pisula
7 months ago

I think this is a bad thing because the save should be forced by the user.

Last edited 7 months ago by sebastian.pisula (previous) (diff)

#6 in reply to: ↑ 3 @SergeyBiryukov
7 months ago

Introduced in [1664], modified in [1752], [3373], [20023].

Replying to afercia:

I think this has always been intentional. and not an issue per se. Maybe worth discussing on the whys.

Right, this was mentioned in #forums last night, noted quite a few times here and there before, and has been somewhat of a hidden feature for 13 years :)

Note: See TracTickets for help on using tickets.