#wordpress 2026-01-07

2026-01-07 UTC
gRegor, unskble, DanQ, [Murray], [Mike_Mai], [rose], rose, gRegorLove_ and [pfefferle] joined the channel
# 20:08 
[pfefferle] [dshanske] is there a reason why we allow "unsafe" requests? https://github.com/pfefferle/wordpress-webmention/blob/c3ecf35986c8d3c035f90feda27fcd3bd99b622c/includes/class-request.php#L25
# 20:08 
[pfefferle] WordFence sees that as an issue!?
[eri], [Al_Abut] and [tantek]4 joined the channel
# 21:38 
GWG Yes, there is
# 21:40 
GWG I may be misremembering, but I definitely think someone pointed out the spec doesn't limit nonstandard ports 
# 21:41 
GWG Also localhost for testing/dev
# 22:23 
[pfefferle] let's keep testing aside. I think the main issue for them (they have a pending CVE) is the MF2::parse_authorpage
# 22:31 
GWG [pfefferle]: What about it? 
# 22:32 
GWG Are they concerned it could end up maliciously retrieving something?
# 22:33 
GWG Not trying to identify the author with image and name instead of url would degrade the experience 
# 22:35 
GWG If it is just removing the safe issue, there probably is an easy way to address 
DanQ joined the channel; burgeonlab left the channel