Changeset 63715 for branches/4.7/src/wp-admin/includes/plugin.php

Timestamp:

09/17/2026 09:15:04 PM (6 hours ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.1.1 security fixes to the 4.7 branch.

• Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
• XML-RPC: Reject writes to internal-only builtin post types.
• Administration: Add authorization check to wp_ajax_sample_permalink().
• Customize: Improve header_image_data theme mod sanitization.
• Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
• Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.

Merges r63657, r63659, r63660, r63665, r63669, r63672 to the 4.7 branch.

Props xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, johnbillion, peterwilsoncc, lancewillett, jonsurrell, dmsnell, whyisjake, buffer1024, joehoyle, rafiem.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/plugin.php (modified) (1 diff)

branches/4.7/src/wp-admin/includes/plugin.php

@@ -499 +499 @@
  *
  * @since 3.0.0
- *
- * @param string $plugin Plugin to check
+ * @since 7.1.1 The `$plugin` path is normalized with `plugin_basename()` and `trim()`,
+ *              matching how `activate_plugin()` resolves it.
+ *
+ * @param string $plugin Path to the plugin file. Accepts a path relative to the plugins
+ *                       directory, or an absolute path, with or without surrounding whitespace.
  * @return bool True if plugin is network only, false otherwise.
  */
 function is_network_only_plugin( $plugin ) {
+        // Normalize the path the same way activate_plugin() does, so both agree on the file.
+        $plugin = plugin_basename( trim( $plugin ) );
+
         $plugin_data = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
         if ( $plugin_data )