Assert the existence of ABSPATH in wp-settings.php

[wet]

wp-settings.php is publicly visible from an URL like ​http://example.com/wp-settings.php and discloses web server internals like the absolute file system path through PHP notices, as ABSPATH is not defined under such circumstances:

Warning: require(ABSPATHwp-includes/compat.php) [function.require]: failed to open stream: No such file or directory in /[...]/wp-settings.php on line 246

Attached patch fixes this behaviour.

[g30rg3x]

From Ticket #1038
Quoting Viper007Bond:

IMO, if you're that worried about paths, then you should have error reporting off.And the path is only a "problem" if you're on a shared server with poor security.

Recommend "wontfix".

[wet]

In the light of the ​current ​CYA ​swoop, would this patch be eventually reconsidered for commit?

[westi]

Replying to wet:

In the light of the ​current ​CYA ​swoop, would this patch be eventually reconsidered for commit?

Those changes were about checking capabilities and stopping the direct load of admin files which shouldn't be called directly.

Adding these checks at the top of every file does not improve security and as was said above you should not have error_reporting outputting to the end-user on a live site.

[ocean90]

#24561 was marked as a duplicate.