16 reputation
2
bio website radiok.info
location Newark, DE
age 33
visits member for 2 years, 3 months
seen Sep 11 at 20:13

PHP and Web Developer on the prowl for exciting new things to break/fix.


Feb
19
awarded  Student
Jun
1
comment Sanitize User Entered CSS
I don't think that would remove potentially bad css like -moz-binding, but I will I will have to look harder at that function's code.
Jun
1
comment Sanitize User Entered CSS
I do agree, but if you look at something simple, like Blog Name. Nonce's are used on the settings page, then before commit sanitize_text is applied to the value. I'm just trying to live up to the same principles of WordPress core, the problem is, WordPress has no need for CSS sanitization, since there's absolutely no where you can enter your own CSS. You could have a CSS file, but that's not vulnerable in the same way, since you authored that file. I digress, the only complete solution I've found is CSSTidy, but I can't easily incorporate that into a plugin.
Jun
1
comment Sanitize User Entered CSS
It is the administrator, and I agree, but $_POST could be compromised between what the admin enters, and what actually gets committed to the database. The admin area is the most vulnerable to CSRF.
Jun
1
asked Sanitize User Entered CSS
Jun
1
awarded  Autobiographer