Make WordPress Core

Changeset 58570


Ignore:
Timestamp:
06/25/2024 02:17:48 PM (3 weeks ago)
Author:
jorbin
Message:

Filesystem: Normalize allowed_files so comparison is apples to apples.

In [58470] a change was made to normalize the filename in validate_file, however this leads to instances where the list of files that are allowed aren't normalized such as in the theme editor. By normalizing the array, the comparison is apples to apples.

Fixes #61488.
Props jorbin, hellofromtonya, swissspidy, misulicus, script2see, Presskopp, audrasjb, peterwilsoncc, siliconforks, littler.chicken, paulkevan,

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/functions.php

    r58470 r58570  
    62006200    }
    62016201
    6202     // Normalize path for Windows servers
     6202    // Normalize path for Windows servers.
    62036203    $file = wp_normalize_path( $file );
     6204    // Normalize path for $allowed_files as well so it's an apples to apples comparison.
     6205    $allowed_files = array_map( 'wp_normalize_path', $allowed_files );
    62046206
    62056207    // `../` on its own is not allowed:
  • trunk/tests/phpunit/tests/functions.php

    r58049 r58570  
    17941794     *
    17951795     * @ticket 42016
     1796     * @ticket 61488
    17961797     * @dataProvider data_validate_file
    17971798     *
     
    19121913                array( 'C:/WINDOWS/system32' ),
    19131914                2,
     1915            ),
     1916
     1917            // Windows Path with allowed file
     1918            array(
     1919                'Apache24\htdocs\wordpress/wp-content/themes/twentyten/style.css',
     1920                array( 'Apache24\htdocs\wordpress/wp-content/themes/twentyten/style.css' ),
     1921                0,
    19141922            ),
    19151923
Note: See TracChangeset for help on using the changeset viewer.