Small bug in sort_by_order_link

  • barteled

    (@barteled)


    11 years, 7 months ago

    The query string is double encoding. Normally the browser will take care of it but it causes issues in some circumstances.
    $query_string = esc_url( remove_query_arg(array( ‘orderby’, ‘order’ )) );
    should be
    $query_string = remove_query_arg(array( ‘orderby’, ‘order’ ));

    remove_query_arg returns a URL query string already. Without remove the esc_url I was getting links like this:
    /wp-admin/edit.php?s&post_status=all&post_type=product&action=-1&m=0&product_cat=anniversary&product_type&paged=1&mode=list&action2=-1

    https://wordpress.org/plugins/simple-page-ordering/

Viewing 1 replies (of 1 total)
  • Plugin Contributor Jake Goldman

    (@jakemgold)

    11 years, 6 months ago

    The escaping is essential to preventing XSS attacks. The URL can be overridden. What’s wrong with what was being returned?

Viewing 1 replies (of 1 total)

The topic ‘Small bug in sort_by_order_link’ is closed to new replies.