Changeset 50037 for trunk

Timestamp:

01/27/2021 11:45:29 PM (6 years ago)

Author:

whyisjake

Message:

Privacy: Ensure that exported user data reports can't be found with directory listings.

By moving from .html to .php files, we can prevent directory listings, and ensure that WordPress can load.

Fixes #52299.

Props lucasbustamante, xkon, freewebmentor, SergeyBiryukov, whyisjake.

Location:

trunk

Files:

• src/wp-admin/includes/privacy-tools.php (modified) (2 diffs)
• src/wp-includes/functions.php (modified) (1 diff)
• tests/phpunit/tests/privacy/wpPrivacyDeleteOldExportFiles.php (modified) (1 diff)
• tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php (modified) (2 diffs)

trunk/src/wp-admin/includes/privacy-tools.php

@@ -323 +323 @@
 
         // Protect export folder from browsing.
-        $index_pathname = $exports_dir . 'index.html';
+        $index_pathname = $exports_dir . 'index.php';
         if ( ! file_exists( $index_pathname ) ) {
                 $file = fopen( $index_pathname, 'w' );
@@ -329 +329 @@
                         wp_send_json_error( __( 'Unable to protect personal data export folder from browsing.' ) );
                 }
-                fwrite( $file, '<!-- Silence is golden. -->' );
+                fwrite( $file, '<?php // Silence is golden.' );
                 fclose( $file );
         }

trunk/src/wp-includes/functions.php

@@ -7399 +7399 @@
 
         require_once ABSPATH . 'wp-admin/includes/file.php';
-        $export_files = list_files( $exports_dir, 100, array( 'index.html' ) );
+        $export_files = list_files( $exports_dir, 100, array( 'index.php' ) );
 
         /**

trunk/tests/phpunit/tests/privacy/wpPrivacyDeleteOldExportFiles.php

@@ -56 +56 @@
                 }
 
-                self::$index_path          = $exports_dir . 'index.html';
+                self::$index_path          = $exports_dir . 'index.php';
                 self::$expired_export_file = $exports_dir . 'wp-personal-data-file-0123456789abcdef.zip';
                 self::$active_export_file  = $exports_dir . 'wp-personal-data-file-fedcba9876543210.zip';

trunk/tests/phpunit/tests/privacy/wpPrivacyGeneratePersonalDataExportFile.php

@@ -215 +215 @@
 
         /**
-         * Test that an index.html file can be added to the export directory.
+         * Test that an index.php file can be added to the export directory.
          *
          * @ticket 44233
@@ -223 +223 @@
                 wp_privacy_generate_personal_data_export_file( self::$export_request_id );
 
-                $this->assertTrue( file_exists( self::$exports_dir . 'index.html' ) );
+                $this->assertTrue( file_exists( self::$exports_dir . 'index.php' ) );
         }