WordPress.org

Make WordPress Core

Opened 2 years ago

Last modified 2 years ago

#40440 new defect (bug)

Save permalink without send form

Reported by: sebastian.pisula Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Rewrite Rules Keywords: has-patch
Focuses: Cc:

Description

if somebody open wp-admin/options-permalink.php, .htaccess are genereate and save without click submit button.

I report this bug as security issue but during send messages with John Blackbourn we have determined that this isn't a security bug so I add ticket as public.

Attachments (1)

fix.patch (657 bytes) - added by sebastian.pisula 2 years ago.

Download all attachments as: .zip

Change History (7)

#1 @sebastian.pisula
2 years ago

  • Keywords has-patch added

#2 @lukecavanagh
2 years ago

fix.patch Patch applies cleanly and does fix that issue. Confirmed on a live site that .htaccess was being written to on permalink options load and not permlink options save.

#3 follow-up: @afercia
2 years ago

I think this has always been intentional. and not an issue per se. Maybe worth discussing on the whys.

See https://codex.wordpress.org/Settings_Permalinks_Screen

Note: Visiting the Permalinks screen triggers a flush of rewrite rules. There is no need to save just to flush the rewrite rules.

#4 @lukecavanagh
2 years ago

Seems like the default should be on save, rather than on load though?

https://codex.wordpress.org/Settings_Permalinks_Screen#Save_Changes

Last edited 2 years ago by lukecavanagh (previous) (diff)

#5 @sebastian.pisula
2 years ago

I think this is a bad thing because the record should be forced by the user.

Version 0, edited 2 years ago by sebastian.pisula (next)

#6 in reply to: ↑ 3 @SergeyBiryukov
2 years ago

Introduced in [1664], modified in [1752], [3373], [20023].

Replying to afercia:

I think this has always been intentional. and not an issue per se. Maybe worth discussing on the whys.

Right, this was mentioned in #forums last night, noted quite a few times here and there before, and has been somewhat of a hidden feature for 13 years :)

Note: See TracTickets for help on using tickets.