Security hardening: escaping, CSRF, SVN URL#81
Merged
Zodiac1978 merged 2 commits intoZodiac1978:developfrom Apr 14, 2026
Merged
Security hardening: escaping, CSRF, SVN URL#81Zodiac1978 merged 2 commits intoZodiac1978:developfrom
Zodiac1978 merged 2 commits intoZodiac1978:developfrom
Conversation
- Add esc_html/esc_url/esc_attr to all unescaped output in render_table_row() - Add nonce verification to cache clear handler - Use wp_nonce_url for cache clear link - Switch SVN check to HTTPS canonical domain - Use rawurlencode on SVN slug - Fix capability check for multisite in settings_page() and AJAX handler
apermo
added a commit
to apermo/plugin-report
that referenced
this pull request
Apr 13, 2026
Same fix as PR Zodiac1978#81 — the old http://svn.wp-plugins.org URL is broken, causing closed plugins to show as "Not found" instead of "Closed".
6 tasks
apermo
added a commit
to apermo/plugin-report
that referenced
this pull request
Apr 13, 2026
Same fix as PR Zodiac1978#81 — the old http://svn.wp-plugins.org URL is broken, causing closed plugins to show as "Not found" instead of "Closed".
This was referenced Apr 13, 2026
DateTime::getTimestamp() returns int but esc_attr() expects string. Fixes PHPStan build-test failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes several security issues identified in #80:
render_table_row()are now wrapped withesc_html(),esc_url(), oresc_attr()as appropriatewp_nonce_url()/wp_verify_nonce()http://svn.wp-plugins.org/(broken SSL cert, plain HTTP) tohttps://plugins.svn.wordpress.org/withrawurlencode()on the slug. Behavior is identical (200 for existing, 404 for non-existent).settings_page()and the AJAX handler now usemanage_siteson multisite, matchingregister_settings_page()Closes #80
Test in WordPress Playground
Before (develop — baseline): Open in WordPress Playground
After (this branch — security hardened): Open in WordPress Playground
Pre-installed test plugins: Apermo Admin Bar (outdated), giWeather (closed/removed)
Test plan