Skip to content

fix: prevent information disclosure in error handling#227

Merged
sushmak02 merged 1 commit intorelease-candidatefrom
fix/information-disclosure
Feb 24, 2026
Merged

fix: prevent information disclosure in error handling#227
sushmak02 merged 1 commit intorelease-candidatefrom
fix/information-disclosure

Conversation

@akshayurankar48
Copy link
Contributor

Summary

  • Replace DateTime exception echo with error_log() to prevent leaking PHP internals (file paths, timezone info) to unauthenticated frontend visitors
  • Return $content unchanged on error instead of bare return
  • Sanitize field_id parameter in oEmbed AJAX response with sanitize_text_field(wp_unslash()) before output

Test plan

  • Verify video schema still renders correctly on frontend
  • Verify invalid video dates are handled gracefully (no visible error)
  • Check error log for DateTime errors instead of frontend output
  • Verify oEmbed embed/remove still works in post editor

Fixes #222

- Replace DateTime exception echo with error_log() to prevent
  leaking PHP internals (file paths, timezone info) to frontend
  visitors; return $content unchanged instead of bare return
- Sanitize field_id parameter in oEmbed AJAX response with
  sanitize_text_field(wp_unslash()) before output

Fixes #222
@akshayurankar48 akshayurankar48 changed the base branch from master to release-candidate February 24, 2026 01:54
@sushmak02 sushmak02 merged commit 5c25c7d into release-candidate Feb 24, 2026
2 checks passed
@sushmak02 sushmak02 deleted the fix/information-disclosure branch February 24, 2026 06:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: Fix information disclosure in error handling

2 participants