Ticket #6871: 6871 version 2.diff

wp-admin/includes/plugin.php

@@ -176 +176 @@
                 return;
         }
 
+        //Invalid is any plugins which are deactivated due to error.
+        $invalid = array();
+
         // If a plugin file does not exist, remove it from the list of active
         // plugins.
         foreach ( $check_plugins as $check_plugin ) {
-                if ( !file_exists(ABSPATH . PLUGINDIR . '/' . $check_plugin) ) {
-                        $current = get_option('active_plugins');
-                        $key = array_search($check_plugin, $current);
-                        if ( false !== $key && NULL !== $key ) {
-                                unset($current[$key]);
-                                update_option('active_plugins', $current);
-                        }
+                $result = validate_plugin($check_plugin);
+                if ( is_wp_error( $result ) ) {
+                        $invalid[ $check_plugin ] = $result;
+                        deactivate_plugins( $check_plugin, true);
                 }
         }
+
+        return $invalid;
 }
 
 function validate_plugin($plugin) {
         if ( validate_file($plugin) )
                 return new WP_Error('plugin_invalid', __('Invalid plugin.'));
+        
         if ( ! file_exists(ABSPATH . PLUGINDIR . '/' . $plugin) )
                 return new WP_Error('plugin_not_found', __('Plugin file does not exist.'));
 
+        $plugins = get_plugins();
+        if ( ! isset($plugins[ $plugin ]) )
+                return new WP_Error('plugin_not_proper', __('Invalid plugin.'));
+
         return 0;
 }
 

wp-admin/plugins.php

@@ -39 +39 @@
 $title = __('Manage Plugins');
 require_once('admin-header.php');
 
-validate_active_plugins();
+$invalid = validate_active_plugins();
+if( ! empty($invalid) )
+        foreach($invalid as $plugin_file => $error)
+                echo '<div id="message" class="updated fade"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to <em>"%s"</em>.'), $plugin_file, $error->get_error_message()) . '</p></div>' 
 
 ?>
 

wp-settings.php

@@ -353 +353 @@
         $current_plugins = get_option('active_plugins');
         if ( is_array($current_plugins) ) {
                 foreach ($current_plugins as $plugin) {
-                        if ('' != $plugin && file_exists(ABSPATH . PLUGINDIR . '/' . $plugin))
+                        if ('' != $plugin && strpos($plugin,'/../') === false && substr($plugin,0,3) != '../' && file_exists(ABSPATH . PLUGINDIR . '/' . $plugin))
                                 include_once(ABSPATH . PLUGINDIR . '/' . $plugin);
                 }
         }