Changeset 42011 for trunk/src/wp-admin/includes/file.php

Timestamp:

10/24/2017 11:14:33 PM (8 years ago)

Author:

johnbillion

Message:

Filesystem API: Add more specificity to the rules for valid files in validate_file().

This now treats files containing ./ as valid, and also treats files containing a trailing ../ as valid due to widespread use of this pattern in theme and plugin zip files.

Adds tests.

Props Ipstenu, borgesbruno, DavidAnderson, philipjohn, birgire
Fixes #42016, #36170

File:

• trunk/src/wp-admin/includes/file.php (modified) (1 diff)

trunk/src/wp-admin/includes/file.php

@@ -664 +664 @@
  * @return string|null
  */
-function validate_file_to_edit( $file, $allowed_files = '' ) {
+function validate_file_to_edit( $file, $allowed_files = array() ) {
     $code = validate_file( $file, $allowed_files );