Twenty Twenty-One: Check if ABSPATH is defined in each file

[tomjdevisser]

I think it would be a nice addition to the Plugin Developers Handbook to add a small recommendation to the Plugin Security section. Basically adding the next snippet to all executable files:

<?php
// Make sure no one can call this file directly
defined( 'ABSPATH' ) or die;

I think most plugin devs will already use this, and it's something that comes up a lot, so I wondered why it was not yet in the documentation. @themiked thought there might be ramifications unknown to us about doing this, so he asked me to make a ticket here. Please share your thoughts.

Some more information on using this:
​https://stackoverflow.com/questions/43212340/what-is-meant-by-if-defined-abspath
​https://wordpress.stackexchange.com/questions/108418/what-are-the-differences-between-wpinc-and-abspath

PS: This is my first ticket, and I don't know exactly what focuses/type/keywords would fit. If anything needs changing, constructive feedback is highly appreciated.

[tomjdevisser]

For added security, I think it would be a nice addition to the theme to add the following code to each file in the theme:

<?php
<?php
// Make sure no one can call this file directly
defined( 'ABSPATH' ) or die;

Some more information on using this:
​https://stackoverflow.com/questions/43212340/what-is-meant-by-if-defined-abspath
​https://wordpress.stackexchange.com/questions/108418/what-are-the-differences-between-wpinc-and-abspath

PS: This is my first ticket, and I don't know exactly what focuses/type/keywords would fit. If anything needs changing, constructive feedback is highly appreciated. Changed the ticket after getting feedback from themiked.

[SergeyBiryukov]

Hi there, welcome to WordPress Trac!

Thanks for the ticket, we're already tracking this enhancement in #47154.

[tomjdevisser]

Replying to SergeyBiryukov:

Hi there, welcome to WordPress Trac!

Thanks for the ticket, we're already tracking this enhancement in #47154.

Great, thanks!