[wp-trac] [WordPress Trac] #46898: WSOD Protection: Finalize email language

[WordPress Trac]

#46898: WSOD Protection: Finalize email language
-------------------------------+-----------------------------
 Reporter:  TimothyBlynJacobs  |       Owner:  SergeyBiryukov
     Type:  defect (bug)       |      Status:  closed
 Priority:  normal             |   Milestone:  5.2
Component:  Administration     |     Version:  trunk
 Severity:  normal             |  Resolution:  fixed
 Keywords:  servehappy         |     Focuses:
-------------------------------+-----------------------------

Comment (by WFMattR):

 Where the email body says "Next, visit the page where the error was caught
 (http:// ...)", is there any concern that inexperienced users may click
 URLs that could be dangerous?

 46898.6.alt.diff uses `home_url( $_SERVER['REQUEST_URI'] )`, which would
 include any query string parameters. An attacker could potentially trigger
 a fatal error with a URL that is also dangerous for a logged-in admin to
 visit. Although there are significant limitations (including triggering a
 fatal error and using a malicious query string parameter in a single
 request, that's processed before the fatal error), in some plugins/themes,
 this could let an attacker send a malicious link to an admin inside a
 legitimate email message, without having to know their address.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/46898#comment:25>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform