Ticket #6871: 6871.5.patch

wp-admin/includes/plugin.php

@@ -304 +304 @@
                 return;
         }
 
+        //Invalid is any plugin that is deactivated due to error.
+        $invalid = array(); 
+
         // If a plugin file does not exist, remove it from the list of active
         // plugins.
         foreach ( $check_plugins as $check_plugin ) {
                 $result = validate_plugin($check_plugin);
                 if ( is_wp_error( $result ) ) {
+                        $invalid[$check_plugin] = $result;
                         deactivate_plugins( $check_plugin, true);
                 }
         }
+        return $invalid;
 }
 
 function validate_plugin($plugin) {

wp-admin/plugins.php

@@ -165 +165 @@
 $title = __('Manage Plugins');
 require_once('admin-header.php');
 
-validate_active_plugins();
-
+$invalid = validate_active_plugins();
+if( !empty($invalid) )
+        foreach($invalid as $plugin_file => $error)
+                echo '<div id="message" class="updated fade"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to <em>"%s"</em>.'), $plugin_file, $error->get_error_message()) . '</p></div>';
 ?>
 
 <?php if ( isset($_GET['error']) ) : ?>

wp-settings.php

@@ -417 +417 @@
         $current_plugins = get_option('active_plugins');
         if ( is_array($current_plugins) ) {
                 foreach ($current_plugins as $plugin) {
-                        if ('' != $plugin && file_exists(WP_PLUGIN_DIR . '/' . $plugin))
+                        if ( '' != $plugin && strpos('/' . $plugin, '/../') === false && strpos('\\' . $plugin, '\\..\\') === false
+                        && file_exists(WP_PLUGIN_DIR . '/' . $plugin) )
                                 include_once(WP_PLUGIN_DIR . '/' . $plugin);
                 }
         }