Add some sanitization back in #120
Conversation
| // Enqueue scripts and styles on the edit screen of the Block post type. | ||
| if ( $this->slug === $page ) { | ||
| if ( filter_input( INPUT_GET, 'page' ) === $this->slug ) { |
There was a problem hiding this comment.
Because this isn't sanitized, there shouldn't be a variable $page that can be used for anything.
filter_input() should just run inline.
| @@ -53,7 +53,7 @@ public function validate( $value, $echo ) { | |||
| $content = genesis_custom_blocks()->loader->get_data( 'content' ); | |||
|
|
|||
| return empty( $content ) | |||
| ? urldecode( filter_input( INPUT_GET, 'inner_blocks' ) ) | |||
| ? urldecode( wp_strip_all_tags( filter_input( INPUT_GET, 'inner_blocks' ) ) ) | |||
There was a problem hiding this comment.
wp_strip_all_tags() is similar to what the FILTER_SANITIZE_STRING argument did before I deleted it
| $context = filter_input( INPUT_GET, 'context' ); | ||
|
|
||
| if ( 'edit' === $context ) { | ||
| if ( 'edit' === filter_input( INPUT_GET, 'context' ) ) { |
There was a problem hiding this comment.
Similar to above, because filter_input() isn't sanitizing, it shouldn't be stored in the variable $context, which can be used anywhere.
filter_input() should simply run inline.
|
With this and #119, GCB free looks to be compatible with PHP Though WP And Core might have more changes before the |
|
Hi @dreamwhisper, |
Background
In #119, I removed
FILTER_SANITIZE_STRINGflags for PHP 8.1 compatibilityChanges
Testing instructions
Not needed, just a sanity check would be great