Make WordPress Core

Opened 2 years ago

Closed 2 years ago

Last modified 2 years ago

#61781 closed defect (bug) (fixed)

Use unadulterated WP version in `is_wp_version_compatible()`

Reported by: peterwilsoncc Owned by: costdev
Priority: normal Milestone: 6.7
Component: General Version:
Severity: normal Keywords: has-patch has-unit-tests
Cc: Focuses:

Description

Follow up to #61627.

In [58813] the helper function wp_get_wp_version() was introduced as a way of getting the WordPress version without relying on the $wp_version global. This is to bypass bugs introduced by plugins modifying the value for reasons of security through obscurity.

As is_wp_version_compatible() currently uses the $wp_version global, such a plugin would affect and break the function. Now a helper function exists for getting the unmodified value it would be good to use it.

Test suite considerations: The tests for is_wp_version_compatible() currently modify the value of the WordPress version in order to test that the function works as expected with alpha, beta, RC and WordPress-Develop. The code will need to be written in such a way that this can continue to be tested.

Change History (6)

This ticket was mentioned in ​PR #7104 on ​WordPress/wordpress-develop by ​@costdev.


2 years ago
#1

  • Keywords has-patch has-unit-tests added

This implements the new wp_get_wp_version() helper function to get the unmodified WordPress version for compatibility checks.

A new global, _wp_tests_wp_version has been introduced to allow for testing against different "current" WordPress versions.

#2 @Cybr
2 years ago

I recommend using get_bloginfo( 'version', 'display' ) for anything that prints the "global", and rely on wp_get_wp_version() otherwise. This way, we never have to call the "global" directly.

In addition to addressing is_wp_version_compatible(), list_core_update() might also need to change where it gets its $wp_version.

#3 @peterwilsoncc
2 years ago

@Cybr Yeah, there are a few extra places the new function could be used. Are you able to drop any suggestions on #61627 as I've left it open for increasing the use of the function. get_bloginfo() still uses the global as that's used in the meta tags plugins are trying to hide (​code ref).

#4 @peterwilsoncc
2 years ago

  • Milestone Awaiting Review → 6.7

#5 @peterwilsoncc
2 years ago

  • Resolution → fixed
  • Status assigned → closed

In 58843:

General: Use clean WordPress version in is_wp_version_compatible().

Update is_wp_version_compatible() to use wp_get_wp_version() introduced in [58813] to ensure the value of $wp_version has not been modified by a theme or plugin.

Props costdev, mukesh27, Cybr, sergeybiryukov.
Fixes #61781.

Note: See TracTickets for help on using tickets.