[wp-trac] Re: [WordPress Trac] #7386: clean_url() shouldn't touch dollar, asterisk or single quote characters

[WordPress Trac]

#7386: clean_url() shouldn't touch dollar, asterisk or single quote characters
-----------------------+----------------------------------------------------
 Reporter:  sambauers  |        Owner:  anonymous
     Type:  defect     |       Status:  new      
 Priority:  low        |    Milestone:  2.7      
Component:  General    |      Version:  2.6      
 Severity:  minor      |   Resolution:           
 Keywords:  has-patch  |  
-----------------------+----------------------------------------------------
Changes (by markjaquith):

  * milestone:  2.6.1 => 2.7

Comment:

 Leaving single quotes unescaped would be an XSS security vulnerability.
 I've no objection to the other characters being allowed.  Punting this to
 2.7

-- 
Ticket URL: <http://trac.wordpress.org/ticket/7386#comment:1>
WordPress Trac <http://trac.wordpress.org/>
WordPress blogging software