[wp-trac] Re: [WordPress Trac] #7386: clean_url() shouldn't touch dollar, asterisk or single quote characters

[WordPress Trac]

#7386: clean_url() shouldn't touch dollar, asterisk or single quote characters
-----------------------+----------------------------------------------------
 Reporter:  sambauers  |        Owner:  anonymous
     Type:  defect     |       Status:  new      
 Priority:  low        |    Milestone:  2.7      
Component:  General    |      Version:  2.6      
 Severity:  minor      |   Resolution:           
 Keywords:  has-patch  |  
-----------------------+----------------------------------------------------
Comment (by markjaquith):

 {{{7386.002.diff}}} leaves single-quotes alone for non-display contexts,
 encodes it for display context.  Allows single quote to be passed in
 wp_redirect() contexts (i.e. using {{{sanitize_url()}}}), but doesn't
 allow for XSS in the default (display) context.

-- 
Ticket URL: <http://trac.wordpress.org/ticket/7386#comment:6>
WordPress Trac <http://trac.wordpress.org/>
WordPress blogging software