Closed MichelleBlanchette closed 8 months ago
This is a final change request from the WordPress Plugin Review Team:
Hi, thanks for the changes and helpful explanations. Just a final issue that won't prevent approval at this time, please fix it when able. Data Must be Sanitized, Escaped, and Validated completionist/src/includes/class-asana-interface.php:1832 $referrer = wp_unslash( $_SERVER['HTTP_REFERER'] ); (Although it is a $server variable, the http_referer it can be manipulated by the browser) Regards.
Hi, thanks for the changes and helpful explanations.
Just a final issue that won't prevent approval at this time, please fix it when able.
completionist/src/includes/class-asana-interface.php:1832 $referrer = wp_unslash( $_SERVER['HTTP_REFERER'] );
(Although it is a $server variable, the http_referer it can be manipulated by the browser)
Regards.
I just investigated this and believe it's a non-issue because I esc_url_raw() wherever it ends up actually being used.
esc_url_raw()
This is a final change request from the WordPress Plugin Review Team: