Automattic / themes

Free WordPress themes made by Automattic for WordPress.org and WordPress.com.
https://themeshaper.com
GNU General Public License v2.0
855 stars 346 forks source link

Workflow security issue #7778

Closed vcanales closed 3 months ago

vcanales commented 3 months ago

Calling create-preview-links from the branch is a possible security concern, where the script could be modified.

To avoid it, I've split the workflow in two which makes it so it's not possible to execute code that is modifiable, as a part of the Workflow, by checking out the script from trunk.