Missed int casting on wp-admin/users.php (harmless xss?)

[g30rg3x]

Around Lines 126 to 151...

	if ( empty($_REQUEST['users']) )
		$userids = array(intval($_REQUEST['user']));
	else
		$userids = $_REQUEST['users'];
	...
	foreach ( (array) $userids as $id ) {
		$user = new WP_User($id);
		if ( $id == $current_user->ID ) {
			echo "<li>" . sprintf(__('ID #%1s: %2s <strong>The current user will not be deleted.</strong>'), $id, $user->user_login) . "</li>\n";
		} else {
			echo "<li><input type=\"hidden\" name=\"users[]\" value=\"{$id}\" />" . sprintf(__('ID #%1s: %2s'), $id, $user->user_login) . "</li>\n";
			$go_delete = true;
		}
	}

As we can see on the present code, $id came from either users or user http request variable, user is well casted to integer but users is not so it could lead to and a XSS attack.
However in order to work, the attacker needs at least to know a valid nonce, which is kinda hard so it turns to be a harmless (or poor) XSS.

[g30rg3x]

For Trunk

[ryan]

(In [9814]) Cast to int. Props g30rg3x. fixes #8291

[ryan]

(In [9815]) Cast to int. Props g30rg3x. fixes #8291

[g30rg3x]

Sorry for reopening the ticket...
But legacy branch (2.0) has the same defect.

[g30rg3x]

Forget to change Milestone and version.

[g30rg3x]

For Legacy Brach (2.0)

[DD32]

Is this going to be applied to the legacy branch at all? commit or wontfix please :)

[Denis-de-Bernardy]

​http://core.trac.wordpress.org/ticket/7728#comment:6