WordPress.org

Make WordPress Core

Opened 5 months ago

Closed 2 months ago

#25924 closed defect (bug) (fixed)

Conflicting error messages in plugin editor

Reported by: MattyRob Owned by: nacin
Milestone: 3.9 Priority: normal
Severity: minor Version: 3.8
Component: Plugins Keywords: has-patch
Focuses: administration Cc:

Description

I have recently been testing out the plugin editor in the administration menus. It seems to me that some of the error messages reported are conflicting when attempting to type in files names.

For example, if you enter a file name with a ".." or a "./" in the filenames path the error message reads as:

Sorry, can’t edit files with “..” in the name. If you are trying to edit a file in your WordPress home directory, you can just type the name of the file in.

So the "./" eventually is not correctly being reported back as an error, however this very error message indicates that files in the home directory can be edited. So, type in wp-config.php or .htaccess and another error appears:

No such file exists! Double check the name and try again.

The reason this error is reported is because the code is looking in the wrong places and in fact it seems that file in the home directory cannot be edited.

A simple fix for this, presuming that the plugin editor is indeed only meant to allow editing of files in the wpc-ntent/plugins folder is to change the first error message to something like:

Sorry, can’t edit files with “..” or "./" in the name.

Note, this may affect the theme editor too, but I haven't looked at that.

Attachments (1)

25924.diff (644 bytes) - added by MattyRob 5 months ago.

Download all attachments as: .zip

Change History (5)

MattyRob5 months ago

comment:1 nacin3 months ago

  • Component changed from Administration to Plugins
  • Focuses administration added

comment:2 Latz2 months ago

Related: #25734

comment:3 nacin2 months ago

  • Milestone changed from Awaiting Review to 3.9

So really this dates to a time when there was also a generic file editor that could be used to edit any file. That's not good, obviously. Let's just nuke this error message, it's quite wrong now.

comment:4 nacin2 months ago

  • Owner set to nacin
  • Resolution set to fixed
  • Status changed from new to closed

In 27219:

Simplify error in validate_file_to_edit().

props MattyRob for initial patch.
fixes #25924.

Note: See TracTickets for help on using tickets.