News for hackers. Stuff that matters.

A comment on Blog post id enumeration can lead to unwanted information disclosure.

Re:Blog post id enumeration can lead to unwanted information... by g544s on Monday February 29, 2016 @02:02AM (#11194000)
I played around with my wordpress install. It looks like if a post is ever "published", the ?p=id url will always forward to the permalink url regardless of the post status being changed to "draft" or "pending review". Edge case for sure, but interesting to know.
[ Parent | on HN ]
Re:Blog post id enumeration can lead to unwanted information... by johnchristopher on Monday February 29, 2016 @04:21AM (#11194411)
That's not an edge case. It's a bona fide bug. Back when pretty URL wasn't a thing yet the logic behind the controller should never redirects you to an hidden/draft post.
[ Parent | on HN ]