Changeset 10892 for trunk/wp-settings.php

Timestamp:

04/08/2009 06:34:46 PM (17 years ago)

Author:

ryan

Message:

Require active plugin files to end in .php. Props hakre. fixes #9406

File:

• trunk/wp-settings.php (modified) (1 diff)

trunk/wp-settings.php

@@ -513 +513 @@
 }
 
-if ( get_option('active_plugins') && !defined('WP_INSTALLING') ) {
-    $current_plugins = get_option('active_plugins');
-    if ( is_array($current_plugins) ) {
-        foreach ( $current_plugins as $plugin ) {
-            if ( '' != $plugin && 0 == validate_file($plugin) && file_exists(WP_PLUGIN_DIR . '/' . $plugin) )
-                include_once(WP_PLUGIN_DIR . '/' . $plugin);
-        }
-        unset($plugin);
+$current_plugins = get_option('active_plugins');
+if ( is_array($current_plugins) && !defined('WP_INSTALLING') ) {
+    foreach ( $current_plugins as $plugin ) {
+        // check the $plugin filename
+        // Validate plugin filename
+        if ( validate_file($plugin) // $plugin must validate as file
+            || '.php' != substr($plugin, -4) // $plugin must end with '.php'
+            || !file_exists(WP_PLUGIN_DIR . '/' . $plugin)  // $plugin must exist
+            )
+            continue;
+
+        include_once(WP_PLUGIN_DIR . '/' . $plugin);
     }
-}
+    unset($plugin);
+}
+unset($current_plugins);
 
 require (ABSPATH . WPINC . '/pluggable.php');