Make WordPress Core

Opened 5 years ago

Closed 22 months ago

#16410 closed defect (bug) (duplicate)

Open basedir problem in /wp-includes/theme.php

Reported by: webraket Owned by:
Milestone: Priority: normal
Severity: normal Version: 3.0.4
Component: Themes Keywords: has-patch
Focuses: Cc:


On line 590 in theme.php there's:

if ( is_dir($theme_root . '/' . $theme_dir) && is_readable($theme_root . '/' . $theme_dir) ) {

please change this to:

if ( $theme_dir!=".." && is_dir($theme_root . '/' . $theme_dir) && is_readable($theme_root . '/' . $theme_dir) ) {

is_dir() should not check .. and . folders, this results in open basedir errors when sharing themes between multiple installs. (symlinked)

Attachments (1)

16410.diff (3.7 KB) - added by solarissmoke 5 years ago.

Download all attachments as: .zip

Change History (6)

#1 @solarissmoke
5 years ago

  • Keywords has-patch added

#2 follow-up: @westi
5 years ago

  • Cc westi added
  • Keywords needs-patch added; has-patch removed
  • Milestone changed from Awaiting Review to Future Release
  • Severity changed from major to normal

We should more likely move the check for . and CVS before the if is_dir check and include .. (and probably .svn) in the list of dirs to skip

#3 @dd32
5 years ago

Can we drop CVS out of it when adding .svn?

#4 in reply to: ↑ 2 @solarissmoke
5 years ago

  • Keywords has-patch added; needs-patch removed

Patch updated as per westi's and dd32's comments above. I realised we don't need to check for '..' or even '.svn' specifically because we were already checking for $theme_dir[0] == '.', just needed to move it in front of the is_dir check.

Last edited 5 years ago by solarissmoke (previous) (diff)

5 years ago

#5 @ocean90
22 months ago

  • Milestone Future Release deleted
  • Resolution set to duplicate
  • Status changed from new to closed

Duplicate of #20103.

Fixed in [20020].

Note: See TracTickets for help on using tickets.