[wp-trac] [WordPress Trac] #44054: Privacy: Escape the comment link output in the wp_comments_personal_data_exporter() function.
WordPress Trac
noreply at wordpress.org
Sat May 12 15:55:38 UTC 2018
#44054: Privacy: Escape the comment link output in the
wp_comments_personal_data_exporter() function.
----------------------------+----------------------
Reporter: birgire | Owner: iandunn
Type: defect (bug) | Status: closed
Priority: normal | Milestone: 4.9.6
Component: Administration | Version: trunk
Severity: normal | Resolution: fixed
Keywords: gdpr has-patch | Focuses:
----------------------------+----------------------
Changes (by iandunn):
* status: accepted => closed
* resolution: => fixed
Comment:
In [changeset:"43245" 43245]:
{{{
#!CommitTicketReference repository="" revision="43245"
Privacy: Escape comment URLs in personal export file to prevent XSS.
There doesn't appear to be any way for an attacker to introduce malicious
input into the URL, unless a plugin is filtering the URL to add it, but
it's better to be safe than sorry.
Props birgire.
Fixes #44054.
}}}
--
Ticket URL: <https://core.trac.wordpress.org/ticket/44054#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform
More information about the wp-trac
mailing list