Four css files removed between 5.7.x and 5.8 were not included in $_old_files

[WFMattR]

These CSS files were present in WP 5.7.x, but do not appear in WP 5.8:

wp-includes/css/dist/editor/editor-styles.css
wp-includes/css/dist/editor/editor-styles.min.css
wp-includes/css/dist/editor/editor-styles-rtl.css
wp-includes/css/dist/editor/editor-styles-rtl.min.css

They were not included in the $_old_files array in 5.8, so on sites upgraded from older versions, they still remain in place.

[audrasjb]

Hi and thank you for the ticket @WFMattR,

If I understood correctly, those files are deleted but only according to version control. They are still included in WP Core and are built by the build scripts now. Because of that, it looks like they should not be added in $_old_files.

Adding dev-feedback keyword for proper dev review :)

[SergeyBiryukov]

Related: #53687

[WFMattR]

Thanks all.

To clarify, if I install a fresh copy of WP 5.8, I don't see those files, but if I update a site from WP 5.7.2 to WP 5.8, the old files remain in place. The timestamps on those files on the upgraded site are before the update as well.

In the past, an upgraded site has normally had the same files in wp-admin and wp-includes as a fresh installation. In Wordfence, WP core files that don't appear in the official zip are shown in scans as a low severity issue, and usually we don't see any after a normal WP upgrade, (unless a host uses a non-standard method of updating an installation in-place).

[johnbillion]

These files are not present in the download package from wordpress.org

[ocean90]

Replying to audrasjb:

If I understood correctly, those files are deleted but only according to version control. They are still included in WP Core and are built by the build scripts now. Because of that, it looks like they should not be added in $_old_files.

That's not true as can be seen on ​https://build.trac.wordpress.org/browser/tags/5.7.2/wp-includes/css/dist/editor vs ​https://build.trac.wordpress.org/browser/tags/5.8/wp-includes/css/dist/editor. The files are indeed removed.

The patch on #53687 will fix this.

[johnbillion]

The patch on #53687 needs more work because if the files are present from pre-5.8 on a git/svn checkout, the files don't get deleted. I think they need to be deleted in the clean task.

[pbiron]

I can confirm that I just updated a 5.7.2 site via cli and got the following output:

Updating to version 5.8 (en_US)...
Using cached file 'C:\Users\pbiron/.wp-cli/cache/core/wordpress-5.8-en_US.zip'...
Unpacking the update...
Cleaning up files...
File removed: wp-includes/css/dist/editor/editor-styles-rtl.css
File removed: wp-includes/css/dist/editor/editor-styles-rtl.min.css
File removed: wp-includes/css/dist/editor/editor-styles.css
File removed: wp-includes/css/dist/editor/editor-styles.min.css
4 files cleaned up.
Success: WordPress updated successfully.

[jesspinkman]

As a user,

after update to 5.8.
wp core verify-checksums flags those 4 files.

Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.css
Success: WordPress installation verifies against checksums.

also wordfence scan gives an alert, so this will probably confuse a bunch of users.

[johnbillion]

#53718 was marked as a duplicate.

[desrosj]

If I understood correctly, those files are deleted but only according to version control. They are still included in WP Core and are built by the build scripts now. Because of that, it looks like they should not be added in $_old_files.

This was the reasoning I had given @audrasjb for this, but looking further, it seems that was incorrect.

I think there was something going on with my local environment where a renamed file renamed and not removed properly. I've opened #53719 to investigate that.

But looks like these files can be safely added to $_old_files.

[roundaboutweb]

I have the same problem on many sites:

/html/wordpress > wp core verify-checksums
Warning: File doesn't exist: readme.html
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.min.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles.css
Warning: File should not exist: wp-includes/css/dist/editor/editor-styles-rtl.css
Error: WordPress installation doesn't verify against checksums

And also message in Wordfence:
​https://nextcloud.roundaboutweb.info/index.php/s/RaQzx6p4SYqBJ4Q

[audrasjb]

#53742 was marked as a duplicate.

[ocean90]

#53751 was marked as a duplicate.

[desrosj]

In 51497:

Upgrade/Install: Add files for 5.8 to the $_old_files list that were missed.

Follow up to [51133], [51459].

Props WFMattR, audrasjb, ocean90, johnbillion, pbiron.
Fixes #53702.

[desrosj]

Reopening for backport to the 5.8 branch.

[desrosj]

In 51509:

Upgrade/Install: Add files for 5.8 to the $_old_files list that were missed.

Follow up to [51133], [51459].

Props WFMattR, audrasjb, ocean90, johnbillion, pbiron.
Merges [51497] to the 5.8 branch.
Fixes #53702.

[jorgefilipecosta]

In 51538:

Block Editor: Add missing border setting on button block.

This commit fixes a regression on WordPress 5.8 that made the border radius setting on the buttons block disappear.

Props Mamaduka, daisyo, priethor, desrosj, mikeschroder.
Fixes #53702.

[SergeyBiryukov]

[51538] was meant for #53697.

[yaels]

I'm a bit confused about this whole situation because I don't work in this field. I got the same warning notification about these four files from Sucuri.

Can I just go ahead and delete these files? I don't really know what I'm supposed to do. Thanks in advance for your help!!

[youssefmh]

Hey @yaels !

Hope you are doing well!

Those files should cause any issue if you delete them. However, they also won't cause any issues if let them there.
I just deleted them from my test site and everything is fine.

Furthermore, I assume that the next WordPress version/update will fix the issue.

Cheers!
Youssef