WordPress.org

Make WordPress Core

Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#34844 closed defect (bug) (duplicate)

Primary network site loads with any arbitrary path on sub-folder networks

Reported by: mordauk Owned by:
Milestone: Priority: normal
Severity: normal Version: 4.4
Component: Networks and Sites Keywords: has-patch needs-testing reporter-feedback
Focuses: multisite Cc:

Description (last modified by SergeyBiryukov)

Take this example:

  • Network install with subfolders
  • Primary site is /
  • Any number of sites in the network

On some server setups (including WordPress.org itself), if you navigate to site.com/a-non-registered-site-path the primary site is loaded, whereas the expected behavior is for a site not found error.

Screenshot of network admin at site.com/:
https://cldup.com/OGIvbqftgW-2000x2000.png
Screenshot of network admin at site.com/a-non-registered-site-path:
https://cldup.com/qh6r9CGdhL-2000x2000.png

This happens because $paths in get_site_by_path() includes both a-non-registered-site-path and / as allowed paths which are then used for the IN statement of the SQL to find the current site:

$sql = $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s", $domains[0] );
$sql .= " AND path IN ($search_paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1";
$site = $wpdb->get_row( $sql );

I've managed to fix the issue by only adding / to $paths if $paths is empty.

I found a related discussion in #31507 and some related comments in #27003 where get_site_by_path() was first introduced but none of them quite address this issue.

Attachments (1)

34844.patch (366 bytes) - added by mordauk 5 years ago.

Download all attachments as: .zip

Change History (6)

@mordauk
5 years ago

#1 @mordauk
5 years ago

  • Keywords has-patch needs-testing added

#2 @joshlevinson
5 years ago

  • Keywords reporter-feedback added

On some server setups (including WordPress.org itself)

Any more details on what's necessary server-wise to replicate for testing?

#3 @jeremyfelt
5 years ago

Thanks for the patch @mordauk. I have a feeling this is a duplicate of #17376. In one of the later comments, I laid out a series of URLs and expectations, but left out any network admin URLs. I'm guessing they act the same.

Can you check that out and confirm?

#4 @jeremyfelt
5 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to duplicate
  • Status changed from new to closed

Fairly convinced this is a duplicate of #17376, which we should be able to fix this cycle with the help of tests via #34941.

#5 @SergeyBiryukov
5 years ago

  • Description modified (diff)
Note: See TracTickets for help on using tickets.