Changeset 10892 for trunk/wp-settings.php

Timestamp:

04/08/2009 06:34:46 PM (17 years ago)

Author:

ryan

Message:

Require active plugin files to end in .php. Props hakre. fixes #9406

File:

• trunk/wp-settings.php (modified) (1 diff)

trunk/wp-settings.php

@@ -513 +513 @@
 }
 
-if ( get_option('active_plugins') && !defined('WP_INSTALLING') ) {
-        $current_plugins = get_option('active_plugins');
-        if ( is_array($current_plugins) ) {
-                foreach ( $current_plugins as $plugin ) {
-                        if ( '' != $plugin && 0 == validate_file($plugin) && file_exists(WP_PLUGIN_DIR . '/' . $plugin) )
-                                include_once(WP_PLUGIN_DIR . '/' . $plugin);
-                }
-                unset($plugin);
+$current_plugins = get_option('active_plugins');
+if ( is_array($current_plugins) && !defined('WP_INSTALLING') ) {
+        foreach ( $current_plugins as $plugin ) {
+                // check the $plugin filename
+                // Validate plugin filename
+                if ( validate_file($plugin) // $plugin must validate as file
+                        || '.php' != substr($plugin, -4) // $plugin must end with '.php'
+                        || !file_exists(WP_PLUGIN_DIR . '/' . $plugin)  // $plugin must exist
+                        )
+                        continue;
+
+                include_once(WP_PLUGIN_DIR . '/' . $plugin);
         }
-}
+        unset($plugin);
+}
+unset($current_plugins);
 
 require (ABSPATH . WPINC . '/pluggable.php');