Tag Info

Hot answers tagged

3

What you're doing at the moment is okay, but there are far far better ways to do it. The problem of man in the middle attacks here is that to insert yourself between wordpress.org and a server at a data centre is no easy task, so this scenario is very unlikely. However If you abandon the built in updater and instead rely on git repositories to pull down ...


3

Short answer: No. You can use normal strings for actions, md5'ing them doesn't change anything. The nonce is built from three main pieces of information: Time: The current time() divided by 43200 is worked into the nonce. This is what lets the nonce be changed every 12 hours (43200 seconds in 12 hours). The action string you provide. More on this below. ...


3

esc_html() is more or less lossless — it just turns HTML markup into encoded visible text, so that it's not rendered as markup by browser. Semantically it's escape, so it's meant to be used to make output to page safe. sanitize_text_field() however actually removes all HTML markup, as well as extra whitespace. It leaves nothing but plain text. ...


1

Your update is as secure as a weakest point in your update chain. Since upgrade are done via HTTPS since 3.7 a MITM attack against wordpress.org will be so hard it is not worth your time to even consider protecting yourself against it as anyone with the resources for that will get you in one way or another. The more problematic points are actually the ...


1

What you did wrong here was to prepare those items in the first place. You only run "data" variables through prepare(). You don't run table names, or sort directions, or limits through it. These are part of the SQL command itself, they are not data that refers to information which is stored in a column in the database. Your SELECT query has no data ...


1

It is indeed a security issue to have those left as the defaults, but it is not an extremely serious issue. To mitigate the problem of known default salts, WordPress intentionally recognizes when those values are left as "put your unique phrase here" and will not use that phrase as a key/salt. Instead, it generates random 64 character salts internally and ...



Only top voted, non community-wiki answers of a minimum length are eligible