WordPress.org
Get WordPress

Make WordPress Core

Opened 16 years ago

Closed 16 years ago

#13046 closed defect (bug) (worksforme)

System Path Disclosure

Reported by: lostsnow Owned by:
Priority: normal Milestone:
Component: Themes Version: 2.9.2
Severity: normal Keywords:
Cc: Focuses:

Description

GET /wp-content/themes/default/ or
GET /wp-content/themes/default/footer.php etc.

then I'll see the system path like:

Fatal error: Call to undefined function get_header() in /home/lostsnow/www/lsproc/blog/wp-content/themes/default/index.php  on line 7

Change History (1)

#1 @nacin
16 years ago

  • Milestone Unassigned
  • Priority highest omg bbq → normal
  • Resolution → worksforme
  • Severity critical → normal
  • Status new → closed

This is a "vulnerability" ultimately rooted in display_errors = 1.

Courtesy of the PHP manual:

Note: This is a feature to support your development and should never be used on production systems (e.g. systems connected to the internet).

Note: See TracTickets for help on using tickets.