WordPress.org

Make WordPress Core

Opened 3 weeks ago

Last modified 3 weeks ago

#54182 new enhancement

Use wp_unslash() for $_REQUEST Parameter in wp-admin/admin-post.php file

Reported by: yagniksangani Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 5.8.1
Component: General Keywords: reporter-feedback has-patch
Focuses: administration, coding-standards Cc:

Description (last modified by SergeyBiryukov)

Need to use the wp_unslash() for $_REQUEST['action'], you can see screenshot.

Attachments (3)

wp_screenshot_ys.png (19.8 KB) - added by yagniksangani 3 weeks ago.
Git Diff File
54182.diff (524 bytes) - added by yagniksangani 3 weeks ago.
Diff file
54182.2.diff (23.8 KB) - added by yagniksangani 2 weeks ago.
New Diff File : Added wp_unslash() function for $_REQUESTaction? where needed in files

Download all attachments as: .zip

Change History (6)

@yagniksangani
3 weeks ago

Git Diff File

#1 follow-up: @SergeyBiryukov
3 weeks ago

  • Description modified (diff)
  • Keywords reporter-feedback added

Hi there, welcome back to WordPress Trac! Thanks for the report.

Could you provide some more details about why wp_unslash() is needed here? What would be the steps to reproduce the issue on a clean install?

#2 in reply to: ↑ 1 @yagniksangani
3 weeks ago

Here wp_unslash() needed to remove slashes, we are using $_REQUEST to get parameters, so we need to remove slashes from parameters as per coding standards. And it will also help as per security point of view. Hope now it will be more clear to you.

Hi there, welcome back to WordPress Trac! Thanks for the report.

Could you provide some more details about why wp_unslash() is needed here? What would be the steps to reproduce the issue on a clean install?

@yagniksangani
3 weeks ago

Diff file

#3 @sabernhardt
3 weeks ago

  • Keywords has-patch added

14 other files in the wp-admin directory also use $_REQUEST['action'] without wp_unslash. If the change is necessary in admin-post.php, those may need the same.

Since changeset:41205, the two files with $_REQUEST['action'] in wp-includes both use the function (class-wp-customize-manager.php and theme.php).

@yagniksangani
2 weeks ago

New Diff File : Added wp_unslash() function for $_REQUESTaction? where needed in files

Note: See TracTickets for help on using tickets.