WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Disallow a self-reference on RSS widget save, which would DoS a site. Checking home/siteurl should cover the vast majority of cases. see #8910. 

git-svn-id: http://svn.automattic.com/wordpress/trunk@17260 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
nacin 2011-01-11 21:37:12 +00:00
parent b8c4418d50
commit 3e45fdb260
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
wp-includes/default-widgets.php
View File

@ -712,6 +712,10 @@ class WP_Widget_RSS extends WP_Widget {
if ( empty($url) ) if ( empty($url) )
return; return;
// self-url destruction sequence
if ( $url == site_url() || $url == home_url() )
return;
$rss = fetch_feed($url); $rss = fetch_feed($url);
$title = $instance['title']; $title = $instance['title'];
$desc = ''; $desc = '';