Stephen Harris

I see your point though - if you're allowing a user to inject script tags on the front-end, that's generally speaking no less a security issue than if there were able to inject it the wp-admin. The principle being explained was that 'escaping' data doesn't make sense without context - escaping data for an SQL statement, rendering, displaying in a textarea all mean different things. The text jumping out of a textarea was a simple illustration of that.

@MarkKaplun True (though iframes, and script tags are usually a big no-no). But even if you want the user to enter unfiltered HTML into a widget. You don't want them to enter unfiltered HTML into wp-admin

@MarkKaplun ping me in chat if you want to continue our discussion data sanitisation. Comments is not the right place for it.

ah, brilliant. Missed that. thanks :)

Sorry, I mean SE. I'd like to see what kind of interactions the perspective mods have had with users

Is there any means of viewing comments left by a particular user? (i.e. a list of recent comments)

@GhostToast - do you still hang around these parts? If so, you should consider creating a separate ticket for core.trac.wordpress.org/ticket/17115 - that said, there are some issues with your patch, what if my post type doesn't support title, content or excerpt?

@toscho why, oh why, did you not use the photo booth at the ball last night? @kaiser rather suits a pink cow-boy hat.

@cjbj You going to WCEU? If so, there's a few of us around that could go for that beer :)

Me too. I think Leiden was the last time I saw everyone. I don't think we've met properly either @kraftner.

@kraftner I was suggesting that those 3465 votes were from his other accounts ;)

@kraftner He has multiple accounts.

@Rarst mustache.php does, but for mustache.js it looks like you have to do something a bit more... hacky...

But then having written that I found this: github.com/janl/mustache.js/issues/277 so it does kind of support helpers

@Rarst That's what I started with, and moved on from them to Handlebars. I really liked it, but you have a limited concept of 'escape' - i.e. you can escape HTML, but not URLs. PHP version has helpers, but JS version does not.

Also looked at Handlebars & LightnCandy (php port) - but that screams at you to cache compiled PHP (fine for client work, less so for public distribution). LightnCandy boasts on its performance but I imagine they are measuring with cache.

Trying to find a workable solution to duplication of templates for PHP and JavaScript. Twig looks most promising so far (it has a .js port).

@Rarst That's what I thought (about the filesystem writes) :)

@Rarst does Meadow cache the compiled php templates or just regenerate them on each page load?

@CoderSte If you were cynical you might conclude that it is to help the government's statistics: "X% of school leavers find employment"

@toscho "What are you expecting to happen?" "For it to work" "What is happening when you run the code?" "It doesn't work"

They deleted sites. And their backups. Oops.

arstechnica.co.uk/security/2016/04/…

@kraftner Nope.,. Honestly, didn't expect to.

@toscho Who else is going to be using the namespace 'WordPress'? :P

@MarkKaplun Never ran wp on php7, but the tests at least pass.

yes and no: Someone followed up on my e-mail for clarification, but I haven't heard anything since...

@MarkKaplun

@userabuser yup

Off topic: anyone else noticed that the pseudo-markdown support in the editor has borked shortcode attributes with an underscore....

As far as Markdownify is concerned it might just be worth manually fixing the php7 - constructor issue (assuming that's all there is...)

github.com/stephenharris/WP-MarkDown/commit/…

and

Specifically: github.com/stephenharris/WP-MarkDown/commit/…

@lkraav That's the one. Though a lot has changed (and looking at the history of WP-Markdown, I think some changes were made to that version to ensure compatability with WP).

@lkraav Its hard-coded in: composer is used only for dev dependencies. wp.org doesn't support composer dependencies.

I'm not really proactive at maintaining it at the moment, as there's always other stuff in the way. I still actively use it (just not on php7 severs ;) )

@lkraav ah, is this the Markdown_Parser dependency? I've not tested it on php7. Happy to accept a PR using a new version if it passes the tests. Just updated GitHub.

@userabuser Are you suggesting its only a matter of time before US foreign policy turns its attention to WordPress plug-ins ;)

@MarkKaplun It's more a case of I work in £ and that's the price in £. How much it costs in $ will vary depending on much the payment gateway wants to charge you :)

@MarkKaplun Yeah... and its not unique to WordPress...

@kraftner I haven't had chance to yet (and probably won't have time before 4.5 is due to be released), but seems fairly clear from the code. But I'll report it to the security team anyway rather than updating the trac

(yes, this is WP and yes this is the same vulnerability we discussed a few days ago... in a public chat room :) )

after all, it comes with the health warning of "dont use on production sites"

@all - responsible disclosure does not apply to vulnerabilities that only exist in beta-versions, right...?

@MarkKaplun In my experience developers (I include myself) can get a bit touchy when someone critiques their work. They probably interpreted it as more derisive then was intended. Still, sad that they would sink to name calling.

@MarkKaplun what's been said?

> PHP has added a new configuration variable max_input_vars, that can limit the number of parameters... This can be easier to use than limiting the length of the HTTP request, because application programmers usually know, how many parameters they need, while the maximum length of the request is harder to predict. However, if a single request parameter contains a data structure, that is later parsed and put into a hash table, the application might still be vulnerable.

Also: cryptanalysis.eu/blog/2011/12/28/…

The security vulnerability that time forgot....