<div class="gmail_quote">On Sat, Oct 16, 2010 at 12:08 PM, Gene Robinson <span dir="ltr"><<a href="mailto:emhr@submersible.me">emhr@submersible.me</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hi,<br>
<br>
I don't in any way claim to be an expert in theme security. I am wondering what are the basic requirements and or recommendations for reviews. I'm finding the use of non-ssl capable functions get_option('home') and get_option('site_url') in links and the lack of wp_nonce_field() and check_admin_referrer() in theme options.</blockquote>
<div><br></div><div>get_option('home') and get_option('siteurl') should *not* be used in themes. I believe the guidelines say so.</div><div><br></div><div>bloginfo('url') (home URL) and bloginfo('wpurl') (site URL) are okay, as they simply call home_url() and site_url() respectively.</div>
<div><br></div><div>The lack of nonce and referrer checks are also a huge concern. Much more than lack of SSL support.</div></div>