WordPress.org

Make WordPress Core

Opened 2 years ago

Last modified 2 years ago

#41597 new enhancement

Language pack download requires too broad file system permissions

Reported by: kpumuk Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 4.9
Component: Upgrade/Install Keywords:
Focuses: administration Cc:
PR Number:

Description

Language packs are installed into wp-content/languages directory. The problem is, even if the directory exists, and WordPress is allowed to create files there, it is still required to:

  • for WordPress to have permissions in the wp-content directory. This is because $upgrader->fs_connect() is called with an array of two directories – WP_CONTENT_DIR and WP_LANG_DIR, and fs_connect() only checks the permissions to the first one.
  • for WordPress to have the exact file owner for the wp-content directory. Cause - wp_can_install_language_pack() calls fs_connect() wihout $allow_relaxed_file_ownership

I think languages, downloaded from a known source, should not require such a draconian measures. Instead, WordPress should successfully download and install languages if it can write to wp-content/languages directory (and not require ownership permissions for either wp-content or wp-content/languages.

Change History (2)

#1 follow-up: @marsjaninzmarsa
2 years ago

Need to remember that language packs are not just pomo files, it may also contain PHP files with permissions to run arbitrary code. Not sure how exactly it's related to above, but security measures should be same as with themes/plugins.

#2 in reply to: ↑ 1 @SergeyBiryukov
2 years ago

Replying to marsjaninzmarsa:

Need to remember that language packs are not just pomo files, it may also contain PHP files with permissions to run arbitrary code.

Strictly speaking, language packs downloaded from translate.wordpress.org do indeed contain only .po/.mo files.

Locale-specific PHP files like sr_RS.php are only present in packages downloaded from local sites like https://sr.wordpress.org/ and are not included in language packs.

Note: See TracTickets for help on using tickets.