[wp-hackers] Any other way to do it? (or, do we really need
elharo at metalab.unc.edu
Fri Mar 2 14:37:16 GMT 2007
Peter Westwood wrote:
> How does switching to POST over GET remove the possibility of security
> holes? They are both just as exploitable from a security point of view
> if they are not given protection.
GET is supposed to be a safe operation. Users are supposed to be able to
follow links without worrying about doing things. In WP, they can't.
This leads to various XSS issues and cracks. It's too easy to get the
admin to follow a link, Indeed this can happen without any explicit user
request at all.
POST is not which is why it can't be linked to, bookmarked, prefetched,
used to grab an image, etc.
interesting question. I need to explore it further. I'm not sure it's
possible, but I'm not sure it isn't either. I suspect the answer may lie
Elliotte Rusty Harold elharo at metalab.unc.edu
Java I/O 2nd Edition Just Published!
More information about the wp-hackers