[wp-trac] [WordPress Trac] #26878: Question mark in the url doesn't return 404 and can be abused

[WordPress Trac]

#26878: Question mark in the url doesn't return 404 and can be abused
--------------------------+-----------------------------
 Reporter:  Andrew8192    |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Permalinks    |    Version:
 Severity:  major         |   Keywords:
--------------------------+-----------------------------
 I'm using wordpress 3.8 downloaded from here:
 http://wordpress.org/download/

 This is a normal url, which returns 404:
 http://twentytendemo.wordpress.com/page/4/example

 This is an url with the question mark, which doesn't return 404:
 http://twentytendemo.wordpress.com/page/4/?/example

 I found about this because I received a mail from my hosting provider,
 saying that they received a complaint about my blog publishing sexual
 content, this is an example of the urls that they received in their
 report:


 {{{
 http://twentytendemo.wordpress.com/page/4/?/board/54-blonde-big-breasts/
 http://twentytendemo.wordpress.com/page/6/?/board/36-sweet-round-booty/
 http://twentytendemo.wordpress.com/page/8/?/board/22-pink-nipples-party/
 }}}

 It was probably a fake report or a joke that someone who doesn't like my
 blog thought, sexual content is not allowed at my hosting provider, I sent
 a reply explaining about the bug and hopefully they won't block my
 account.

 Is this a bug that I can fix on my side, or need to wait for the next
 wordpress version update?

--
Ticket URL: <https://core.trac.wordpress.org/ticket/26878>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform