Context Navigation

← Previous Ticket
Next Ticket →

#54278 closed defect (bug) (fixed)

Properly escape form action url

Reported by:	sabbirshouvo	Owned by:	SergeyBiryukov
Priority:	normal	Milestone:	5.9
Component:	Upgrade/Install	Version:
Severity:	normal	Keywords:	has-patch commit
Cc:		Focuses:	coding-standards

Description

In wp-admin/update-core.php there are 4 forms with action. Thress of them has form action with properly escaped URL. One of them is missing URL escaping while the value of action for all of them is the same.

Attachments (1)

54278.diff (519 bytes ) - added by sabbirshouvo 5 years ago.

Download all attachments as: .zip

Change History (5)

@sabbirshouvo
5 years ago

Attachment 54278.diff added

#1 @sabbirshouvo
5 years ago

Component General → Upgrade/Install

#2 @mukesh27
5 years ago

Keywords commit added
Milestone Awaiting Review → 5.9
Version trunk

Hi there, thanks for the ticket and patch!

The patch looks good to me and ready to marge.

Moving to milestone 5.9 and marking for commit.

#3 @SergeyBiryukov
5 years ago

Owner set to SergeyBiryukov
Resolution → fixed
Status new → closed

In 51914:

Coding Standards: Consistently escape form action URL in wp-admin/update-core.php.

Follow-up to [10166], [23739], [25806].

Props sabbirshouvo, mukesh27.
Fixes #54278.

This ticket was mentioned in Slack in #core by sergey. View the logs.

5 years ago

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core