Changeset 12310

Timestamp:

12/01/2009 10:03:13 PM (17 years ago)

Author:

ryan

Message:

Fix file validation in theme editor. Props dd32. fixes #11032

Location:

trunk

Files:

• wp-admin/includes/file.php (modified) (2 diffs)
• wp-admin/plugin-editor.php (modified) (2 diffs)
• wp-admin/theme-editor.php (modified) (6 diffs)
• wp-includes/functions.php (modified) (1 diff)

trunk/wp-admin/includes/file.php

@@ -196 +196 @@
  */
 function validate_file_to_edit( $file, $allowed_files = '' ) {
-        $file = stripslashes( $file );
-
         $code = validate_file( $file, $allowed_files );
 
@@ -207 +205 @@
                         wp_die( __('Sorry, can’t edit files with “..” in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.' ));
 
-                case 2 :
-                        wp_die( __('Sorry, can’t call files with their real path.' ));
+                //case 2 :
+                //      wp_die( __('Sorry, can’t call files with their real path.' ));
 
                 case 3 :

trunk/wp-admin/plugin-editor.php

@@ -23 +23 @@
 
 if ( isset($_REQUEST['file']) )
-        $plugin = $_REQUEST['file'];
+        $plugin = stripslashes($_REQUEST['file']);
 
 if ( empty($plugin) ) {
@@ -34 +34 @@
 if ( empty($file) )
         $file = $plugin_files[0];
+else
+        $file = stripslashes($file);
 
 $file = validate_file_to_edit($file, $plugin_files);

trunk/wp-admin/theme-editor.php

@@ -36 +36 @@
         $file = $allowed_files[0];
 } else {
+        $file = stripslashes($file);
         if ( 'theme' == $dir ) {
                 $file = dirname(dirname($themes[$theme]['Template Dir'])) . $file ; 
@@ -43 +44 @@
 }
 
-$real_file = validate_file_to_edit($file, $allowed_files);
+validate_file_to_edit($file, $allowed_files);
 $scrollto = isset($_REQUEST['scrollto']) ? (int) $_REQUEST['scrollto'] : 0;
-
 $file_show = basename( $file );
 
@@ -56 +56 @@
         $newcontent = stripslashes($_POST['newcontent']);
         $theme = urlencode($theme);
-        if (is_writeable($real_file)) {
+        if (is_writeable($file)) {
                 //is_writable() not always reliable, check return value. see comments @ http://uk.php.net/is_writable
-                $f = fopen($real_file, 'w+');
+                $f = fopen($file, 'w+');
                 if ($f !== FALSE) {
                         fwrite($f, $newcontent);
@@ -84 +84 @@
         update_recently_edited($file);
 
-        if ( !is_file($real_file) )
+        if ( !is_file($file) )
                 $error = 1;
 
-        if ( !$error && filesize($real_file) > 0 ) {
-                $f = fopen($real_file, 'r');
-                $content = fread($f, filesize($real_file));
-
-                if ( '.php' == substr( $real_file, strrpos( $real_file, '.' ) ) ) {
+        if ( !$error && filesize($file) > 0 ) {
+                $f = fopen($file, 'r');
+                $content = fread($f, filesize($file));
+
+                if ( '.php' == substr( $file, strrpos( $file, '.' ) ) ) {
                         $functions = wp_doc_link_parse( $content );
 
@@ -103 +103 @@
 
                 $content = htmlspecialchars( $content );
-                $codepress_lang = codepress_get_lang($real_file);
+                $codepress_lang = codepress_get_lang($file);
         }
 
@@ -213 +213 @@
 
                 <div>
-<?php if ( is_writeable($real_file) ) : ?>
+<?php if ( is_writeable($file) ) : ?>
                         <p class="submit">
 <?php

trunk/wp-includes/functions.php

@@ -3069 +3069 @@
                 return 1;
 
+        if (!empty ( $allowed_files ) && (!in_array( $file, $allowed_files ) ) )
+                return 3;
+
         if (':' == substr( $file, 1, 1 ))
                 return 2;
-
-        if (!empty ( $allowed_files ) && (!in_array( $file, $allowed_files ) ) )
-                return 3;
 
         return 0;