Changeset 12310

Timestamp:

12/01/2009 10:03:13 PM (15 years ago)

Author:

ryan

Message:

Fix file validation in theme editor. Props dd32. fixes #11032

Location:

trunk

Files:

• wp-admin/includes/file.php (modified) (2 diffs)
• wp-admin/plugin-editor.php (modified) (2 diffs)
• wp-admin/theme-editor.php (modified) (6 diffs)
• wp-includes/functions.php (modified) (1 diff)

trunk/wp-admin/includes/file.php

@@ -196 +196 @@
  */
 function validate_file_to_edit( $file, $allowed_files = '' ) {
-    $file = stripslashes( $file );
-
     $code = validate_file( $file, $allowed_files );
 
@@ -207 +205 @@
             wp_die( __('Sorry, can’t edit files with “..” in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.' ));
 
-        case 2 :
-            wp_die( __('Sorry, can’t call files with their real path.' ));
+        //case 2 :
+        //  wp_die( __('Sorry, can’t call files with their real path.' ));
 
         case 3 :

trunk/wp-admin/plugin-editor.php

@@ -23 +23 @@
 
 if ( isset($_REQUEST['file']) )
-    $plugin = $_REQUEST['file'];
+    $plugin = stripslashes($_REQUEST['file']);
 
 if ( empty($plugin) ) {
@@ -34 +34 @@
 if ( empty($file) )
     $file = $plugin_files[0];
+else
+    $file = stripslashes($file);
 
 $file = validate_file_to_edit($file, $plugin_files);

trunk/wp-admin/theme-editor.php

@@ -36 +36 @@
     $file = $allowed_files[0];
 } else {
+    $file = stripslashes($file);
     if ( 'theme' == $dir ) {
         $file = dirname(dirname($themes[$theme]['Template Dir'])) . $file ; 
@@ -43 +44 @@
 }
 
-$real_file = validate_file_to_edit($file, $allowed_files);
+validate_file_to_edit($file, $allowed_files);
 $scrollto = isset($_REQUEST['scrollto']) ? (int) $_REQUEST['scrollto'] : 0;
-
 $file_show = basename( $file );
 
@@ -56 +56 @@
     $newcontent = stripslashes($_POST['newcontent']);
     $theme = urlencode($theme);
-    if (is_writeable($real_file)) {
+    if (is_writeable($file)) {
         //is_writable() not always reliable, check return value. see comments @ http://uk.php.net/is_writable
-        $f = fopen($real_file, 'w+');
+        $f = fopen($file, 'w+');
         if ($f !== FALSE) {
             fwrite($f, $newcontent);
@@ -84 +84 @@
     update_recently_edited($file);
 
-    if ( !is_file($real_file) )
+    if ( !is_file($file) )
         $error = 1;
 
-    if ( !$error && filesize($real_file) > 0 ) {
-        $f = fopen($real_file, 'r');
-        $content = fread($f, filesize($real_file));
-
-        if ( '.php' == substr( $real_file, strrpos( $real_file, '.' ) ) ) {
+    if ( !$error && filesize($file) > 0 ) {
+        $f = fopen($file, 'r');
+        $content = fread($f, filesize($file));
+
+        if ( '.php' == substr( $file, strrpos( $file, '.' ) ) ) {
             $functions = wp_doc_link_parse( $content );
 
@@ -103 +103 @@
 
         $content = htmlspecialchars( $content );
-        $codepress_lang = codepress_get_lang($real_file);
+        $codepress_lang = codepress_get_lang($file);
     }
 
@@ -213 +213 @@
 
         <div>
-<?php if ( is_writeable($real_file) ) : ?>
+<?php if ( is_writeable($file) ) : ?>
             <p class="submit">
 <?php

trunk/wp-includes/functions.php

@@ -3069 +3069 @@
         return 1;
 
+    if (!empty ( $allowed_files ) && (!in_array( $file, $allowed_files ) ) )
+        return 3;
+
     if (':' == substr( $file, 1, 1 ))
         return 2;
-
-    if (!empty ( $allowed_files ) && (!in_array( $file, $allowed_files ) ) )
-        return 3;
 
     return 0;