WordPress.org

Make WordPress Core

Opened 2 months ago

Closed 2 months ago

Last modified 7 weeks ago

#53702 closed defect (bug) (fixed)

Four css files removed between 5.7.x and 5.8 were not included in $_old_files

Reported by: WFMattR Owned by: desrosj
Milestone: 5.8.1 Priority: normal
Severity: normal Version: 5.8
Component: Upgrade/Install Keywords: has-patch fixed-major
Focuses: Cc:

Description

These CSS files were present in WP 5.7.x, but do not appear in WP 5.8:

wp-includes/css/dist/editor/editor-styles.css
wp-includes/css/dist/editor/editor-styles.min.css
wp-includes/css/dist/editor/editor-styles-rtl.css
wp-includes/css/dist/editor/editor-styles-rtl.min.css

They were not included in the $_old_files array in 5.8, so on sites upgraded from older versions, they still remain in place.

Attachments (1)

53702.diff (612 bytes) - added by desrosj 2 months ago.

Download all attachments as: .zip

Change History (23)

#1 follow-up: @audrasjb
2 months ago

  • Keywords dev-feedback added

Hi and thank you for the ticket @WFMattR,

If I understood correctly, those files are deleted but only according to version control. They are still included in WP Core and are built by the build scripts now. Because of that, it looks like they should not be added in $_old_files.

Adding dev-feedback keyword for proper dev review :)

#2 @SergeyBiryukov
2 months ago

Related: #53367, #53687

Last edited 2 months ago by SergeyBiryukov (previous) (diff)

#3 @WFMattR
2 months ago

Thanks all.

To clarify, if I install a fresh copy of WP 5.8, I don't see those files, but if I update a site from WP 5.7.2 to WP 5.8, the old files remain in place. The timestamps on those files on the upgraded site are before the update as well.

In the past, an upgraded site has normally had the same files in wp-admin and wp-includes as a fresh installation. In Wordfence, WP core files that don't appear in the official zip are shown in scans as a low severity issue, and usually we don't see any after a normal WP upgrade, (unless a host uses a non-standard method of updating an installation in-place).

#4 @johnbillion
2 months ago

These files are not present in the download package from wordpress.org

#5 in reply to: ↑ 1 @ocean90
2 months ago

  • Keywords dev-feedback removed
  • Milestone changed from Awaiting Review to 5.8.1

Replying to audrasjb:

If I understood correctly, those files are deleted but only according to version control. They are still included in WP Core and are built by the build scripts now. Because of that, it looks like they should not be added in $_old_files.

That's not true as can be seen on https://build.trac.wordpress.org/browser/tags/5.7.2/wp-includes/css/dist/editor vs https://build.trac.wordpress.org/browser/tags/5.8/wp-includes/css/dist/editor. The files are indeed removed.

The patch on #53687 will fix this.

#6 @johnbillion
2 months ago

The patch on #53687 needs more work because if the files are present from pre-5.8 on a git/svn checkout, the files don't get deleted. I think they need to be deleted in the clean task.

#7 @pbiron
2 months ago

I can confirm that I just updated a 5.7.2 site via cli and got the following output:

Updating to version 5.8 (en_US)...
Using cached file 'C:\Users\pbiron/.wp-cli/cache/core/wordpress-5.8-en_US.zip'...
Unpacking the update...
Cleaning up files...
File removed: wp-includes/css/dist/editor/editor-styles-rtl.css
File removed: wp-includes/css/dist/editor/editor-styles-rtl.min.css
File removed: wp-includes/css/dist/editor/editor-styles.css
File removed: wp-includes/css/dist/editor/editor-styles.min.css
4 files cleaned up.
Success: WordPress updated successfully.

#8 @jesspinkman
2 months ago

As a user,

after update to 5.8.
wp core verify-checksums flags those 4 files.

Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.css
Success: WordPress installation verifies against checksums.

also wordfence scan gives an alert, so this will probably confuse a bunch of users.

#9 @johnbillion
2 months ago

#53718 was marked as a duplicate.

#10 @desrosj
2 months ago

  • Keywords has-patch added

If I understood correctly, those files are deleted but only according to version control. They are still included in WP Core and are built by the build scripts now. Because of that, it looks like they should not be added in $_old_files.

This was the reasoning I had given @audrasjb for this, but looking further, it seems that was incorrect.

I think there was something going on with my local environment where a renamed file renamed and not removed properly. I've opened #53719 to investigate that.

But looks like these files can be safely added to $_old_files.

@desrosj
2 months ago

#11 @roundaboutweb
2 months ago

I have the same problem on many sites:

/html/wordpress > wp core verify-checksums
Warning: File doesn't exist: readme.html
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.css
Error: WordPress installation doesn't verify against checksums

And also message in Wordfence:
https://nextcloud.roundaboutweb.info/index.php/s/RaQzx6p4SYqBJ4Q

#12 @audrasjb
2 months ago

#53742 was marked as a duplicate.

#13 @ocean90
2 months ago

#53751 was marked as a duplicate.

#14 @desrosj
2 months ago

  • Owner set to desrosj
  • Resolution set to fixed
  • Status changed from new to closed

In 51497:

Upgrade/Install: Add files for 5.8 to the $_old_files list that were missed.

Follow up to [51133], [51459].

Props WFMattR, audrasjb, ocean90, johnbillion, pbiron.
Fixes #53702.

#15 @desrosj
2 months ago

  • Keywords fixed-major added
  • Resolution fixed deleted
  • Status changed from closed to reopened

Reopening for backport to the 5.8 branch.

#16 @desrosj
2 months ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 51509:

Upgrade/Install: Add files for 5.8 to the $_old_files list that were missed.

Follow up to [51133], [51459].

Props WFMattR, audrasjb, ocean90, johnbillion, pbiron.
Merges [51497] to the 5.8 branch.
Fixes #53702.

#17 @jorgefilipecosta
8 weeks ago

In 51538:

Block Editor: Add missing border setting on button block.

This commit fixes a regression on WordPress 5.8 that made the border radius setting on the buttons block disappear.

Props Mamaduka, daisyo, priethor, desrosj, mikeschroder.
Fixes #53702.

This ticket was mentioned in Slack in #core-editor by andraganescu. View the logs.


8 weeks ago

This ticket was mentioned in Slack in #core by andraganescu. View the logs.


8 weeks ago

#21 @yaels
7 weeks ago

I'm a bit confused about this whole situation because I don't work in this field. I got the same warning notification about these four files from Sucuri.

Can I just go ahead and delete these files? I don't really know what I'm supposed to do. Thanks in advance for your help!!

#22 @youssefmh
7 weeks ago

Hey @yaels !

Hope you are doing well!

Those files should cause any issue if you delete them. However, they also won't cause any issues if let them there.
I just deleted them from my test site and everything is fine.

Furthermore, I assume that the next WordPress version/update will fix the issue.

Cheers!
Youssef

Note: See TracTickets for help on using tickets.