Ticket #42609: 42609.diff

src/wp-admin/includes/file.php

@@ -433 +433 @@
                         switch ( $type ) {
                                 case 'php':
                                         $allowed_files = array_merge( $allowed_files, $theme->get_files( 'php', -1 ) );
                                         break;
                                 case 'css':
                                         $style_files = $theme->get_files( 'css', -1 );
                                         $allowed_files['style.css'] = $style_files['style.css'];
                                         $allowed_files = array_merge( $allowed_files, $style_files );
                                         break;
                                 default:
                                         $allowed_files = array_merge( $allowed_files, $theme->get_files( $type, -1 ) );
                                         break;
                         }
                 }
 
-                if ( 0 !== validate_file( $real_file, $allowed_files ) ) {
+                if ( 0 !== validate_file( $file, array_keys( $allowed_files ) ) ) {
                         return new WP_Error( 'disallowed_theme_file', __( 'Sorry, that file cannot be edited.' ) );
                 }
 
                 $is_active = ( get_stylesheet() === $stylesheet || get_template() === $stylesheet );
         } else {
                 return new WP_Error( 'missing_theme_or_plugin' );
         }
 
         // Ensure file is real.
         if ( ! is_file( $real_file ) ) {
                 return new WP_Error( 'file_does_not_exist', __( 'No such file exists! Double check the name and try again.' ) );
         }
 
         // Ensure file extension is allowed.
         $extension = null;