Allow block themes to be activated without index.php

[poena]

Block themes (themes built with support for full site editing) have to include an index.php file to be activated, even though the new format does not use index.php, but index.html
(inside a block-templates folder).

Block themes should not need to include this unused file in order to be activated.

If the theme does not include index.php, this message is shown:
Template is missing. Standalone themes need to have a index.php template file

[sabbirshouvo]

Allow block themes without index.php if either index.php or block-templates/index.html is present in a theme folder, theme will activate without any issue. If a theme missing both, a notice will be shown as previous.

[manfcarlo]

What are the security implications of omitting index.php?

[overclokk]

Replying to manfcarlo:

What are the security implications of omitting index.php?

In the theme is used only for the WP "router" and also as a fallback.

[manfcarlo]

Replying to overclokk:

Replying to manfcarlo:

What are the security implications of omitting index.php?

In the theme is used only for the WP "router" and also as a fallback.

No, I'm talking about using it for "silence is golden" purpose.

[hellofromTonya]

As of yesterday, 5.9 is now in Feature Freeze. Moving this ticket to the next release cycle. But 6.0 is not yet available for selection. Moving it to Future Release. Once 6.0 is available, please feel free to move it into that milestone.

[andraganescu]

This needs a refresh as block-templates was replaced by simply templates, plus it's unclear if we need to update themes to work without index.php or ​include an empty index.php as a requirement anyway.

[scruffian]

Rename block-templates to templates.

[scruffian]

IMO we should remove the index.php requirement, I can't see what value it adds. I have added a new diff to achieve this.

[SergeyBiryukov]

Thanks for the patches!

54272.3.diff​ is a minor adjustment to make the "or" part of the string translatable too.

[SergeyBiryukov]

In 54272.4.diff​:

• Check for templates/index.html first, as block themes would likely be more common in the future.
• Update the documentation.

[SergeyBiryukov]

Replying to manfcarlo:

What are the security implications of omitting index.php?

I think including an empty index.php file to prevent directory listing may still be a good practice, but it does not have to be a requirement for themes.

[SergeyBiryukov]

In 52940:

Themes: Allow block themes to be activated without index.php.

This removes the requirement for block themes to have an unused index.php template just for activation, as they use a templates/index.html file instead.

The updated requirements are as follows:

• Standalone themes need to have a templates/index.html or index.php template file.
• Child themes need to have a Template header in the style.css stylesheet.

Follow-up to [52069], [52247].

Props poena, sabbirshouvo, scruffian, manfcarlo, overclokk, andraganescu, SergeyBiryukov.
Fixes #54272.

[milana_cap]

Marking for dev note but really just needs mentioning in Field guide.