Uncaught exception 'Error' with multiple messages in wp-include directory files during direct access

[deepakrohilla]

wp-includes folder .php extension files include in others files not loaded directly. If someone encounter and address direct access of wp-includes directory files, will return 500 error, so restrict direct access call in wp-includes and its sub directories to ensure all code works well.

These are the lists of files which encountered error on direct access.

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/class-wp-customize-control.php:707
Request URI : <domain-name>/wp-includes/class-wp-customize-control.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/ms-blogs.php:11
Request URI : <domain-name>/wp-includes/ms-blogs.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/class-wp-http.php:11
Request URI : <domain-name>/wp-includes/class-wp-http.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/class-wp-customize-panel.php:411
Request URI : <domain-name>/wp-includes/class-wp-customize-panel.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/class-wp-customize-setting.php:964
Request URI : <domain-name>/wp-includes/class-wp-customize-setting.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/ms-settings.php:35
Request URI : <domain-name>/wp-includes/ms-settings.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/nav-menu-template.php:11
Request URI : <domain-name>/wp-includes/nav-menu-template.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/wp-diff.php:13
Request URI : <domain-name>/wp-includes/wp-diff.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/class-IXR.php:42
Request URI : <domain-name>/wp-includes/class-IXR.php

Uncaught exception 'Error' with message 'Call to undefined function is_main_site()' in /var/www/wp-includes/update.php:1080
Request URI : <domain-name>/wp-includes/update.php

Uncaught exception 'Error' with message 'Call to undefined function is_admin()' in /var/www/wp-includes/vars.php:23
Request URI : <domain-name>/wp-includes/vars.php

Uncaught exception 'Error' with message 'Call to undefined function add_shortcode()' in /var/www/wp-includes/media.php:2173
Request URI : <domain-name>/wp-includes/media.php

Uncaught exception 'Error' with message 'Call to undefined function add_filter()' in /var/www/wp-includes/default-filters.php:22
Request URI : <domain-name>/wp-includes/default-filters.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/functions.php:8
Request URI : <domain-name>/wp-includes/functions.php

Uncaught exception 'Error' with message 'Undefined constant "ABSPATH"' in /var/www/wp-includes/default-widgets.php:11
Request URI : <domain-name>/wp-includes/default-widgets.php

Uncaught exception 'Error' with message 'Call to undefined function feed_content_type()' in /var/www/wp-includes/feed-atom.php:8
Request URI : <domain-name>/wp-includes/feed-atom.php

Uncaught exception 'Error' with message 'Class "SimplePie_Sanitize" not found' in /var/www/wp-includes/class-wp-simplepie-sanitize-kses.php:21
Request URI : <domain-name>/wp-includes/class-wp-simplepie-sanitize-kses.php

Uncaught exception 'Error' with message 'Class "Text_Diff_Renderer" not found' in /var/www/wp-includes/class-wp-text-diff-renderer-table.php:17
Request URI : <domain-name>/wp-includes/class-wp-text-diff-renderer-table.php

Fix direct accessibility of wp-includes directory multiple files.

[audrasjb]

As per yesterdays Core early tickets bug scrub: The performance tests were failing so we agreed to restart them to make sure it wasn't a false alert.

I did restart them, and it appears all the test are now passing ✅

Thus I'm self assigning the ticket to ship it in 6.8 :)

[audrasjb]

In 59678:

General: Stop direct loading of files in /wp-admin that should only be included.

This changeset restricts direct access call in /wp-admin and its sub directories.

Follow-up to [11768].

Props deepakrohilla.
See #61314.

[audrasjb]

@deepakrohilla I committed part of you changes, those related to /wp-admin folder.
Concerning changes located in /wp-includes, I noticed a lot of files not modified by your PR. For example, you modified default-filters.php but not default-constants.php. Was it on purpose? There's a lot of other files with the same question. Thanks.

[deepakrohilla]

@audrasjb Thank you for committing the changes related to the /wp-admin folder.

Regarding the /wp-includes folder, the modifications in my PR were focused on addressing specific fatal errors, such as the "Uncaught Error" issue. Files like default-constants.php and others were not modified because they did not return any errors. For example, direct access to /wp-includes/embed.php also does not trigger any errors, which is why default-constants.php was left unchanged.

[flixos90]

Thanks @audrasjb for taking this one, I was just about to take a look at it :)

I agree with your feedback that we should add the conditional check on every file that shouldn't be directly accessible, except files that have only a single class. I think for all other files there is no clear guidance on whether or not to include any function calls or hook additions directly in the root of the file, so it's safer to always have them.

FWIW this aligns with plugin directory guidelines that any non-class (or non-interface or non-trait) file should have such a check.

[audrasjb]

Alrighty thank you both! Then I will start committing the other changes addressed by the PR then reopen this ticket so we can address the remaining files.

[audrasjb]

In 59688:

General: Stop direct loading of files in /wp-includes that should only be included.

This changeset restricts direct access call in /wp-includes and its sub directories.

Follow-up to [11768], [59678].

Props deepakrohilla.
Fixes #61314.

Committed in:

• https://core.trac.wordpress.org/changeset/59678
• https://core.trac.wordpress.org/changeset/59688

[audrasjb]

Reopening to address more occurrences (I'll add a new PR soon).

[swissspidy]

btw, this issue has come up numerous times in the past, see #36177 and all the tickets that were closed as duplicates. See also #18546

[audrasjb]

Closing this ticket as fixed. Please feel free to open new follow-up tickets if needed.

[domainsupport]

Following @audrasjb's invitation to open follow-up tickets if needed, could you please clarify whether the direct-access guards added in [59678] were intended to cover files such as:

• /wp-admin/includes/admin.php
• /wp-admin/includes/deprecated.php

I have observed third parties directly requesting both of these files in production access logs, with HTTP 500 responses. Direct access to /wp-admin/includes/admin.php reproduces the get_locale() fatal error reported in #58788.

I have added further details to #58788 in comment 5, since that is the existing ticket for admin.php. However, it was closed as wontfix before the changes made under this ticket established precedent for adding direct-access guards to selected files in /wp-admin and /wp-includes.

Were these two files intentionally excluded from [59678]? If not, would you prefer #58788 to be reopened and expanded to include deprecated.php, or should I open a narrowly scoped follow-up ticket covering the omitted files?

I wanted to ask here first to avoid creating a duplicate of #58788 or #62724.