Theme doesn't load properly when theme directory name contains a '+' sign

[ming]

A theme directory that contains the '+' symbol causes WP to choke on the directory name. Once activated WP can no longer access the theme directory so the site is blank (view source is completely empty).

The 'current theme' section contains no information: ie
"All of this theme’s files are located in ."

I haven't checked other symbols besides the plus sign

Using WAMP development server on WinXP
WP version 2.1-alpha3 nightly build (oct 22?)

[Viper007Bond]

I don't have the problem here on 4419. Instead, I am just unable to activate the theme as the activate URL is incorrect:

http://localhost/wordpress-latest/wp-admin/themes.php?action=activate&template=clas%20sic&stylesheet=clas%20sic&_wpnonce=506392aeae

<a href="themes.php?action=activate&amp;template=clas sic&amp;stylesheet=clas sic&#038;_wpnonce=506392aeae" class="screenshot">

The plus sign gets turned into a space.

[matt]

We should probably disallow this.

[tombarta]

why not just pass it through rawurlencode() when outputting to HTML and rawurldecode() when pulling from input? It'll just convert it to %2B in the page, it doesn't require additional rules for theme developers, and it is indicative that there's a XSS or similar vulnerability lurking around.

A little bit of noodling here...

shell> cp -a classic '" onclick="alert('\''Moo!'\'')"'

When I tried to select this theme from the admin interface, my browser mooed at me.

While this may be for the most part trivial (if you can write the wordpress files you probably have more privileges than wordpress itself does), it does have the potential to be exploited in rare cases.

[markjaquith]

I don't agree that this is a security issue. If you can write to the theme directory, you can easily take over the blog.

[Speedboxer]

In 2.2 a theme with a + symbol can't even get past activation. The plus gets turned into %20 in the URL and never gets activated.

[westi]

I believe this is caused by the same issue as #4873 we need to urlencode some stuff.

Attaching patch

[westi]

urlencode the arguments that come from the folder names

[markjaquith]

Yep, good call.

[westi]

(In [6016]) urlencode the theme name and stylesheet name in the activate links so as to support directories with + in the name. Fixes #3279.