Make WordPress Core

Opened 3 years ago

Closed 3 years ago

#27441 closed defect (bug) (wontfix)

SHORTINIT - formatting.php required by some functions

Reported by: jesin Owned by:
Milestone: Priority: normal
Severity: normal Version: 3.8.1
Component: Bootstrap/Load Keywords: has-patch
Focuses: Cc:


This is my first bug report with a patch file, so please correct me if I have choosen something wrong.

When SHORTINIT is used the wp-includes/formatting.php file is not included. Certain functions which are defined in this file are being used by other functions. So calling any of these functions throws a Fatal Error.


  • sanitize_file_name() is called in wp-includes/functions.php by the function wp_unique_filename()
  • sanitize_option() is called in wp-includes/option.php by several functions - add_option(), update_option(), add_site_option() and update_site_option()

Reproducing this error:

Create a file inside the WordPress installation directory with the following code.

define( 'SHORTINIT', true );
require_once $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php';
var_dump( add_option( 'foobar', 'Hello World' ) );

Access this file on the browser and the following error is displayed (debugging should be enabled of course).

Fatal error: Call to undefined function sanitize_option() in wp-includes/option.php on line 305


Manually include the file in your code.

define( 'SHORTINIT', true );
require_once $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php';
require_once ABSPATH . WPINC . '/formatting.php';
var_dump( add_option( 'foobar', 'Hello World' ) );

I have attached a patch which includes the formatting.php file before the SHORTINIT check.

Attachments (1)

27441.diff (815 bytes) - added by jesin 3 years ago.
Patch for this bug

Download all attachments as: .zip

Change History (6)

3 years ago

Patch for this bug

#1 @nacin
3 years ago

Hi jesin, great bug report and a perfect patch.

Unfortunately SHORTINIT was never designed for non-internal use. One problem with doing this is then we commit to always maintaining this in the future. Our bootstrapping is a bit too fragile to take on this additional burden. The moment we patch this, we take on the responsibility of keeping this working for the long term.

If you are doing something with SHORTINIT and you need formatting functions, you should include them on your own. Or, you should use all of wp-load.php. Once you include formatting.php, it carries with it all sorts of other dependencies, and so on. It's best to let SHORTINIT live frozen in time.

#2 @jesin
3 years ago

  • Keywords has-patch added

Hi Andrew,

I think I have not explained this clearly.

I do NOT need any formatting functions provided by formatting.php but other functions loaded before SHORTINIT do.

As I said already SHORTINIT loads option.php which uses sanitize_* functions in several places.

In short the already included files (before SHORTINIT) require formatting.php not me ;-).

I hope I made my point clear.

#3 @maratbn
3 years ago

In addition, calling 'plugin_dir_path(...)' or 'plugin_dir_url(...)' which are in 'plugin.php' in SHORTINIT mode results in PHP error "Call to undefined function trailingslashit()", which is also in 'formatting.php'.

And 'plugin_dir_url(...)' also has a dependency on 'plugins_url(...)' that is in 'link-template.php'.

Function 'get_option(...)' has a dependency on 'wp_cache_get(...)' that is in 'cache.php'.

Seeing this with WordPress version 3.9

So generally it looks like there is a lot of unusable logic in the SHORTINIT mode because it has dependencies on logic that is only available outside of the SHORTINIT mode.

Perhaps the SHORTINIT mode should be split up into an even "shorter" SHORTINIT mode that does not have any of this unusable logic, and a "longer" SHORTINIT mode that does have the dependencies included...

Last edited 3 years ago by maratbn (previous) (diff)

#4 @michalzuber
3 years ago

Tried and reproduced with success. I don't know why was that constant introduced, but after testing it, it's really a tiny piece from WP core.
Found some cases where somebody used SHORTINIT:

If it will somebody ever use, they just require files that they need.
It's not stated that everything will work in SHORTINIT environment.
Error introduced in this ticket pointed out that sanitize_* functions won't work.
For debugging this, somebody had to call every function in SHORTINIT state.

Tried in root dir:

define( 'SHORTINIT', true );
require_once( dirname( __FILE__ ) . '/wp-load.php' );
$funcs = get_defined_functions();
echo "WordPress $wp_version SHORTINIT functions: <pre>"; print_r($funcs['user']); echo "</pre>";

the output showed 234 functions

#5 @nacin
3 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to wontfix
  • Status changed from new to closed

The only purpose of SHORTINIT was for ms-files.php, an MU vestige we cast aside in 3.5. I wish it never entered core. I don't expect there to be any changes here, based on my initial comment.

Note: See TracTickets for help on using tickets.