WordPress.org
Get WordPress

Make WordPress Core

Opened 3 years ago

Closed 13 months ago

#58511 closed defect (bug) (fixed)

Escaping function missing in wp-trackback.php

Reported by: utsav72640 Owned by: SergeyBiryukov
Priority: normal Milestone: 6.9
Component: Pings/Trackbacks Version:
Severity: normal Keywords: has-patch
Cc: Focuses: coding-standards

Description

Escaping function missing in wp-trackback.php file.

Attachments (2)

trackback.patch​ (1.0 KB ) - added by utsav72640 3 years ago.
wp-trackback.php
updatedtrackback.patch​ (1.0 KB ) - added by utsav72640 3 years ago.

Download all attachments as: .zip

Change History (9)

@utsav72640
3 years ago

wp-trackback.php

#1 @ankitmaru
3 years ago

Thanks @utsav72640

Patch LGTM.

#2 @mukesh27
3 years ago

  • Keywords needs-refresh added
  • Version 6.2.2

Hi there! thanks for ticket and patch.

The core use sanitize_text_field( wp_unslash( $_POST[''] ) ); instead of what you propose in your patch.

@utsav72640
3 years ago

#3 @utsav72640
3 years ago

Thank you for sharing the details, @mukesh27. I have attached a new patch. Could you please review it and let me know if any changes. Thanks!!!

#4 @ankitmaru
3 years ago

Great.!!!! Thanks @mukesh27 for quick review.

This ticket was mentioned in ​PR #9387 on ​WordPress/wordpress-develop by ​@dhruvang21.
13 months ago #5

  • Keywords needs-refresh removed

#6 @SergeyBiryukov
13 months ago

  • Milestone Awaiting Review → 6.9

#7 @SergeyBiryukov
13 months ago

  • Owner set to SergeyBiryukov
  • Resolution → fixed
  • Status new → closed

In 60646:

Coding Standards: Sanitize input values in wp-trackback.php.

Follow-up to [4676], [12284], [23594], [53719].

Props utsav72640, mukesh27, ankitmaru, dhruvang21, SergeyBiryukov.
Fixes #58511.

Note: See TracTickets for help on using tickets.