Make WordPress Core

Opened 20 months ago

Closed 15 months ago

Last modified 14 months ago

#54272 closed enhancement (fixed)

Allow block themes to be activated without index.php

Reported by: poena's profile poena Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 6.0 Priority: normal
Severity: normal Version:
Component: Themes Keywords: has-patch commit add-to-field-guide
Focuses: template Cc:

Description

Block themes (themes built with support for full site editing) have to include an index.php file to be activated, even though the new format does not use index.php, but index.html
(inside a block-templates folder).

Block themes should not need to include this unused file in order to be activated.

If the theme does not include index.php, this message is shown:
Template is missing. Standalone themes need to have a index.php template file

Attachments (4)

54272.diff (1.7 KB) - added by sabbirshouvo 20 months ago.
Allow block themes without index.php if either index.php or block-templates/index.html is present in a theme folder, theme will activate without any issue. If a theme missing both, a notice will be shown as previous.
54272.2.diff (1.7 KB) - added by scruffian 15 months ago.
Rename block-templates to templates.
54272.3.diff (1.9 KB) - added by SergeyBiryukov 15 months ago.
54272.4.diff (2.6 KB) - added by SergeyBiryukov 15 months ago.

Download all attachments as: .zip

Change History (21)

@sabbirshouvo
20 months ago

Allow block themes without index.php if either index.php or block-templates/index.html is present in a theme folder, theme will activate without any issue. If a theme missing both, a notice will be shown as previous.

#1 @sabbirshouvo
20 months ago

  • Focuses template added
  • Keywords has-patch added

#2 follow-ups: @manfcarlo
20 months ago

What are the security implications of omitting index.php?

#3 in reply to: ↑ 2 ; follow-up: @overclokk
20 months ago

Replying to manfcarlo:

What are the security implications of omitting index.php?

In the theme is used only for the WP "router" and also as a fallback.

This ticket was mentioned in Slack in #core-themes by poena. View the logs.


20 months ago

#5 in reply to: ↑ 3 @manfcarlo
20 months ago

Replying to overclokk:

Replying to manfcarlo:

What are the security implications of omitting index.php?

In the theme is used only for the WP "router" and also as a fallback.

No, I'm talking about using it for "silence is golden" purpose.

#6 @hellofromTonya
19 months ago

  • Milestone changed from 5.9 to Future Release

As of yesterday, 5.9 is now in Feature Freeze. Moving this ticket to the next release cycle. But 6.0 is not yet available for selection. Moving it to Future Release. Once 6.0 is available, please feel free to move it into that milestone.

#7 @SergeyBiryukov
19 months ago

  • Milestone changed from Future Release to 6.0

This ticket was mentioned in Slack in #core by audrasjb. View the logs.


18 months ago

#9 @andraganescu
16 months ago

  • Keywords dev-feedback needs-refresh added

This needs a refresh as block-templates was replaced by simply templates, plus it's unclear if we need to update themes to work without index.php or include an empty index.php as a requirement anyway.

@scruffian
15 months ago

Rename block-templates to templates.

#10 @scruffian
15 months ago

IMO we should remove the index.php requirement, I can't see what value it adds. I have added a new diff to achieve this.

#11 @SergeyBiryukov
15 months ago

  • Owner set to SergeyBiryukov
  • Status changed from new to reviewing

#12 @SergeyBiryukov
15 months ago

  • Keywords commit added; dev-feedback needs-refresh removed

Thanks for the patches!

54272.3.diff is a minor adjustment to make the "or" part of the string translatable too.

#13 @SergeyBiryukov
15 months ago

In 54272.4.diff:

  • Check for templates/index.html first, as block themes would likely be more common in the future.
  • Update the documentation.

#14 in reply to: ↑ 2 @SergeyBiryukov
15 months ago

Replying to manfcarlo:

What are the security implications of omitting index.php?

I think including an empty index.php file to prevent directory listing may still be a good practice, but it does not have to be a requirement for themes.

#15 @SergeyBiryukov
15 months ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

In 52940:

Themes: Allow block themes to be activated without index.php.

This removes the requirement for block themes to have an unused index.php template just for activation, as they use a templates/index.html file instead.

The updated requirements are as follows:

  • Standalone themes need to have a templates/index.html or index.php template file.
  • Child themes need to have a Template header in the style.css stylesheet.

Follow-up to [52069], [52247].

Props poena, sabbirshouvo, scruffian, manfcarlo, overclokk, andraganescu, SergeyBiryukov.
Fixes #54272.

#16 @milana_cap
14 months ago

  • Keywords needs-dev-note added

Marking for dev note but really just needs mentioning in Field guide.

#17 @milana_cap
14 months ago

  • Keywords add-to-field-guide added; needs-dev-note removed
Note: See TracTickets for help on using tickets.