5 ms·
You should never directly work with the WordPress global variables, and it's bad practice to do so. Use wp_get_current_user: https://codex.wordpress.org/Functi
by claudiulodro 9y ago
You should never directly work with the WordPress global variables, and it's bad practice to do so.
Use wp_get_current_user: https://codex.wordpress.org/Function_Reference/wp_get_current_user https://codex.wordpress.org/Function_Reference/wp_get_curren...
The largest attack surface for WP is poorly developed plugins and themes, not WordPress core.
- stephenr 9y ago> You should never directly work with the WordPress global variables, and it's bad practice to do so. It's bad practice to use global variables, but you somehow blame the person who highlights this use, as opposed to the project that is littered with their use.
- nikcub 9y agothe reason why so many plugins and templates are insecure is precisely because they have access to that global scope and misuse it
- stephenr 9y agoYou're missing the point. You're criticising 'plugins and templates' that make use of the global scope, while giving the WordPress core a free-ride for not just using global scope, but placing objects there that can be exploited.
- nikcub 9y agoThat's exactly my point - the core is at fault for handing over global exec to the plugins and templates. It's a horrible design, and it appears there is little motivation to fix it but rather pass blame onto plugins.
- Cozumel 9y agoWordpress shouldn't be using any globals at all. That code doesn't just smell, it reeks.