Looking at our use of FILTER_SANITIZE_STRING here

modify-comment-parent/modify-comment-parent.php

Lines 59 to 74 in 232c557

    
           $nonce          = filter_input( INPUT_POST, 'fe_modify_comment_parent_nonce', FILTER_SANITIZE_STRING ); 
        
           if ( ! $comment_id ) { 
        
           	// We don't have a comment to modify, make no changes. 
        
           	return; 
        
           } 
        
           if ( ! $nonce ) { 
        
           	// We do not have a nonce value, make no changes. 
        
           	return $post_id; 
        
           } 
        
           if ( ! wp_verify_nonce( $nonce, 'fe_modify_comment_parent' ) ) { 
        
           	// Our nonce value does not match the value we set, make no changes. 
        
           	return; 
        
           }

It looks like we're reading the incoming WordPress nonce and passing it into wp_verify_nonce(), based on this I think any filtering of the incoming value is unnecessary.

So we could:

A. Use htmlspecialchars() as called out in Lax's FILTER_SANITIZE_STRING is deprecated, what to use instead? article

B. Drop this filtering all together, which can be done by using FILTER_UNSAFE_RAW as a replacement (this doesn't filter anything but keeps the pattern of extracting the value the same).

C. Something else

Next Steps

I think we should go with option B and eliminate the filtering since it is unnecessary in this particular case.

	$nonce = filter_input( INPUT_POST, 'fe_modify_comment_parent_nonce', FILTER_SANITIZE_STRING );

	if ( ! $comment_id ) {
	// We don't have a comment to modify, make no changes.
	return;
	}

	if ( ! $nonce ) {
	// We do not have a nonce value, make no changes.
	return $post_id;
	}

	if ( ! wp_verify_nonce( $nonce, 'fe_modify_comment_parent' ) ) {
	// Our nonce value does not match the value we set, make no changes.
	return;
	}

PHP 8.3.8 Deprecation Warning FILTER_SANITIZE_STRING #2

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions