Steerpike

It also doesn’t work for me (I notice it actually does make all the links protocol relative — are you seeing the same thing? For example, https://domain.com/blogpost is getting changed to //domain.com/blogpost, but not just /blogpost as expected). I downloaded and installed the previous version (0.1) and it works as expected.

I second that the exploit should be disclosed — if it is what I think it is, then it’s so obvious that we aren’t risking revealing anything to spammers that their botnets can’t already detect plain as day. I edited custom-contact-forms-front.php as follows. I’m a PHP novice, so can you let me know if this is enough to secure the form, or is there more to the exploit?

I replaced:

$dest_email_array = $this->getDestinationEmailArray($form->form_email);

with:

$dest_email_array;

I have the same problem. Works fine in everything but IE9 Beta. I have the wp_footer() call. Any ideas? Thanks!

I’m using Linux hosting. I’ve reproduced the problem on all the domains associated with my hosting account. It only seems to affect WP installs that I set up according to the instructions here. I’ve tried giving WP its own directory both before and after the WP 2.8 upgrade. For the time being, I’ve just moved my entire install to the root, but I’d prefer to keep my domain root less messy by leaving the WP core files in their own directory.

Thanks for the pointer, unfortunately, owners are the same.

Are you running Firefox 3.5 beta 99 by any chance? I have a similar problem in WordPress 2.7.1, but it’s only in the FF beta, so it’s a browser issue, I assume.