WordPress.org

Make WordPress Core

Opened 4 months ago

Last modified 4 months ago

#54182 new enhancement

Use wp_unslash() for $_REQUEST Parameter in wp-admin/admin-post.php file

Reported by: yagniksangani Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.8.1
Component: General Keywords: reporter-feedback has-patch
Focuses: administration, coding-standards Cc:

Description (last modified by SergeyBiryukov)

Need to use the wp_unslash() for $_REQUEST['action'], you can see screenshot.

Attachments (3)

wp_screenshot_ys.png (19.8 KB) - added by yagniksangani 4 months ago.
Git Diff File
54182.diff (524 bytes) - added by yagniksangani 4 months ago.
Diff file
54182.2.diff (23.8 KB) - added by yagniksangani 4 months ago.
New Diff File : Added wp_unslash() function for $_REQUESTaction? where needed in files

Download all attachments as: .zip

Change History (6)

@yagniksangani
4 months ago

Git Diff File

#1 follow-up: @SergeyBiryukov
4 months ago

  • Description modified (diff)
  • Keywords reporter-feedback added

Hi there, welcome back to WordPress Trac! Thanks for the report.

Could you provide some more details about why wp_unslash() is needed here? What would be the steps to reproduce the issue on a clean install?

#2 in reply to: ↑ 1 @yagniksangani
4 months ago

Here wp_unslash() needed to remove slashes, we are using $_REQUEST to get parameters, so we need to remove slashes from parameters as per coding standards. And it will also help as per security point of view. Hope now it will be more clear to you.

Hi there, welcome back to WordPress Trac! Thanks for the report.

Could you provide some more details about why wp_unslash() is needed here? What would be the steps to reproduce the issue on a clean install?

@yagniksangani
4 months ago

Diff file

#3 @sabernhardt
4 months ago

  • Keywords has-patch added

14 other files in the wp-admin directory also use $_REQUEST['action'] without wp_unslash. If the change is necessary in admin-post.php, those may need the same.

Since changeset:41205, the two files with $_REQUEST['action'] in wp-includes both use the function (class-wp-customize-manager.php and theme.php).

@yagniksangani
4 months ago

New Diff File : Added wp_unslash() function for $_REQUESTaction? where needed in files

Note: See TracTickets for help on using tickets.