Potential Secruity Issue – Missing output encoding

Posted in: Newspaper
Post count: 28
newbie
#47736
May 6, 2015 at 2:58 am

in the page-author-box.php parts template (and most likely in more templates) you use the follwoing code:

$part_cur_auth_obj->user_url . ‘”>’ . $part_cur_auth_obj->user_url

echo $part_cur_auth_obj->description

From my point of view this is a potential big security issue. You need to encode them with esc_html / esc_attr / esc_url. Yes WP does most likely do some input sanitization. But it is always very important to also encode the output.
And espcially on this page. This is the user profile. Absolutely every user will have access to this page (but my otherwise be very restricted) and can enter information here.

Thanks

Post count: 1291
Emil G
#47818
May 6, 2015 at 3:59 pm

Hi,

I’ve tested the field with a simple js alert – http://screencast.com/t/BGlyERhnZZb – and wordpress automatically removes the html tags from it, after you save the settings it looks like this – http://screencast.com/t/kEG2m2Tlc – http://screencast.com/t/W2hsTq25

But nonetheless you have a good point and we’ll investigate this, thanks for this note.

Thank you, Emil G.

Viewing 2 posts - 1 through 2 (of 2 total)
The forum ‘Newspaper’ is closed to new topics and replies.