Ticket #58905: 58905.diff

src/wp-includes/template.php

@@ -704 +704 @@
                 if ( ! $template_name ) {
                         continue;
                 }
-                if ( file_exists( STYLESHEETPATH . '/' . $template_name ) ) {
-                        $located = STYLESHEETPATH . '/' . $template_name;
+
+                $stylesheet      = STYLESHEETPATH . '/' . $template_name;
+                $template        = TEMPLATEPATH . '/' . $template_name;
+                $template_compat = ABSPATH . WPINC . '/theme-compat/' . $template_name;
+
+                if ( file_exists( $stylesheet ) && 0 === strpos( realpath( $stylesheet ), realpath( STYLESHEETPATH ) ) ) {
+                        $located = $stylesheet;
                         break;
-                } elseif ( file_exists( TEMPLATEPATH . '/' . $template_name ) ) {
-                        $located = TEMPLATEPATH . '/' . $template_name;
+                } elseif ( file_exists( $template ) && 0 === strpos( realpath( $template ), realpath( TEMPLATEPATH ) ) ) {
+                        $located = $template;
                         break;
-                } elseif ( file_exists( ABSPATH . WPINC . '/theme-compat/' . $template_name ) ) {
-                        $located = ABSPATH . WPINC . '/theme-compat/' . $template_name;
+                } elseif ( file_exists( $template_compat ) && 0 === strpos( realpath( $template_compat ), realpath( ABSPATH . WPINC . '/theme-compat/' ) ) ) {
+                        $located = $template_compat;
                         break;
                 }
         }

tests/phpunit/tests/template.php

@@ -628 +628 @@
                         ),
                 );
         }
+        public function test_locate_template_file_outside_of_the_directory() {
+                $template = locate_template( '../../templates/template.html', false, false );
+                $this->assertEmpty( $template );
+        }
 
+        public function test_locate_template_file_inside_of_the_directory() {
+                $template = locate_template( 'index.php', false, false );
+                $this->assertNotEmpty( $template );
+        }
+
         public function assertTemplateHierarchy( $url, array $expected, $message = '' ) {
                 $this->go_to( $url );
                 $hierarchy = $this->get_template_hierarchy();