fix: use wp_strip_all_tags for token/password sanitization #187
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The sanitize_text_field() function converts encoded octets (e.g., %B2) which can break OAuth tokens and passwords that contain special characters in encoded form. This change replaces sanitize_text_field() with wp_strip_all_tags() for token and password fields. wp_strip_all_tags() removes HTML tags but does not modify encoded octets, making it safe for credential fields. Additional improvements: - Added wp_unslash() for proper magic quotes handling - Added isset() checks for POST variables - Used esc_url_raw() for URL fields - Improved code formatting and inline documentation Fixes #114 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
sanitize_text_field()withwp_strip_all_tags()for token and password fields%B2) from being stripped from OAuth tokens and passwordsProblem
sanitize_text_field()converts encoded octets, which breaks OAuth tokens and passwords containing special characters in encoded form.Solution
Use
wp_strip_all_tags()instead, which removes HTML tags but preserves encoded octets.Additional improvements:
wp_unslash()for proper magic quotes handlingisset()checks for POST variablesesc_url_raw()for URL fieldsTest plan
%B2Fixes #114
🤖 Generated with Claude Code