[wp-trac] [WordPress Trac] #65048: wp_ajax_fetch_list(): Sanitize $_GET input before nonce construction

[WordPress Trac]

#65048: wp_ajax_fetch_list(): Sanitize $_GET input before nonce construction
-------------------------------------+------------------------------
 Reporter:  rajeshcp                 |       Owner:  rajeshcp
     Type:  defect (bug)             |      Status:  assigned
 Priority:  normal                   |   Milestone:  Awaiting Review
Component:  Administration           |     Version:  3.1
 Severity:  normal                   |  Resolution:
 Keywords:  has-patch needs-testing  |     Focuses:
-------------------------------------+------------------------------
Changes (by westonruter):

 * version:  trunk => 3.1
 * severity:  critical => normal


Comment:

 If this is critical and it is a security fix, then it should //not// have
 been reported in Trac but rather [https://hackerone.com/wordpress on
 HackerOne]. Please report the issue there if it is critical, otherwise,
 this seems to be a hardening for a hypothetical issue. (Do not discuss
 here if it is actually not hypothetical. Provide reproduction steps in
 HackerOne.)

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/65048#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform