[wp-trac] [WordPress Trac] #65054: $_GET['pagenow'] and $_GET['widget'] unsanitized in dashboard AJAX handler

[WordPress Trac]

#65054: $_GET['pagenow'] and $_GET['widget'] unsanitized in dashboard AJAX handler
--------------------------+-------------------------------------
 Reporter:  rajeshcp      |      Owner:  rajeshcp
     Type:  defect (bug)  |     Status:  assigned
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Security      |    Version:  trunk
 Severity:  major         |   Keywords:  has-patch needs-testing
  Focuses:                |
--------------------------+-------------------------------------
 $_GET['pagenow'] and $_GET['widget'] unsanitized in dashboard AJAX handler
 Both values are read directly without sanitize_key(). While the
 switch/comparison limits damage, unsanitized
   superglobal access violates WordPress coding standards unconditionally.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65054>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform