Fix all "Call to undefined function" direct access errors

[bor0]

We host WooCommerce.com, and our logs are flooded with "Call to undefined function" errors due to possibly bots accessing random URLs.

Related ticket: #62722

Here is the easiest way to get all "Call to undefined function" issues:

$ wp core download
Downloading WordPress 6.7.1 (en_US)...
md5 hash verified: fae7bae13a158496ab884b6cdb0c5c03
Success: WordPress downloaded.
$ wp config create --dbname=wordpress --dbuser=root
Success: Generated 'wp-config.php' file.
$ wp db create
Success: Database created.
$ wp core install --url=localhost:8080 --title="WordPress" --admin_user=bor0 --admin_password=asdf --admin_email=boro.sitnikovski@automattic.com
Success: WordPress installed successfully.
$ > ~/dev/log/error_log # empty error log
$ find . -name '*.php' | sed 's|^\./||' | xargs -I {} echo "http://localhost:8080/{}" > urls.txt # generate urls
$ xargs -P 10 -n 1 curl -s -o /dev/null < urls.txt # visit each url
$ grep "Call to undefined function" ~/dev/log/error_log | grep -o '/[^ ]*.php' | uniq
/opt/homebrew/var/www/wp-admin/admin-header.php
/opt/homebrew/var/www/wp-admin/options-head.php
/opt/homebrew/var/www/wp-admin/upgrade-functions.php
/opt/homebrew/var/www/wp-admin/admin-functions.php
/opt/homebrew/var/www/wp-admin/network/menu.php
/opt/homebrew/var/www/wp-admin/includes/ms-admin-filters.php
/opt/homebrew/var/www/wp-admin/includes/file.php
/opt/homebrew/var/www/wp-admin/includes/class-wp-upgrader-skins.php
/opt/homebrew/var/www/wp-admin/includes/admin-filters.php
/opt/homebrew/var/www/wp-admin/includes/menu.php
/opt/homebrew/var/www/wp-admin/includes/edit-tag-messages.php
/opt/homebrew/var/www/wp-admin/includes/continents-cities.php
/opt/homebrew/var/www/wp-admin/includes/admin.php
/opt/homebrew/var/www/wp-admin/menu-header.php
/opt/homebrew/var/www/wp-admin/user/menu.php
/opt/homebrew/var/www/wp-admin/custom-header.php
/opt/homebrew/var/www/wp-admin/menu.php
/opt/homebrew/var/www/wp-admin/custom-background.php
/opt/homebrew/var/www/wp-includes/rss.php
/opt/homebrew/var/www/wp-includes/blocks/rss.php
/opt/homebrew/var/www/wp-includes/blocks/term-description.php
/opt/homebrew/var/www/wp-includes/blocks/comment-template.php
/opt/homebrew/var/www/wp-includes/blocks/social-link.php
/opt/homebrew/var/www/wp-includes/blocks/read-more.php
/opt/homebrew/var/www/wp-includes/blocks/site-tagline.php
/opt/homebrew/var/www/wp-includes/blocks/archives.php
/opt/homebrew/var/www/wp-includes/blocks/post-title.php
/opt/homebrew/var/www/wp-includes/blocks/gallery.php
/opt/homebrew/var/www/wp-includes/blocks/latest-posts.php
/opt/homebrew/var/www/wp-includes/blocks/query-no-results.php
/opt/homebrew/var/www/wp-includes/blocks/comment-author-name.php
/opt/homebrew/var/www/wp-includes/blocks/comments-pagination-next.php
/opt/homebrew/var/www/wp-includes/blocks/shortcode.php
/opt/homebrew/var/www/wp-includes/blocks/comments-pagination-previous.php
/opt/homebrew/var/www/wp-includes/blocks/post-terms.php
/opt/homebrew/var/www/wp-includes/blocks/post-comments-form.php
/opt/homebrew/var/www/wp-includes/blocks/query-pagination.php
/opt/homebrew/var/www/wp-includes/blocks/page-list-item.php
/opt/homebrew/var/www/wp-includes/blocks/loginout.php
/opt/homebrew/var/www/wp-includes/blocks/comments.php
/opt/homebrew/var/www/wp-includes/blocks/post-featured-image.php
/opt/homebrew/var/www/wp-includes/blocks/file.php
/opt/homebrew/var/www/wp-includes/blocks/post-template.php
/opt/homebrew/var/www/wp-includes/blocks/site-logo.php
/opt/homebrew/var/www/wp-includes/blocks/legacy-widget.php
/opt/homebrew/var/www/wp-includes/blocks/query-pagination-next.php
/opt/homebrew/var/www/wp-includes/blocks/heading.php
/opt/homebrew/var/www/wp-includes/blocks/comments-title.php
/opt/homebrew/var/www/wp-includes/blocks/post-date.php
/opt/homebrew/var/www/wp-includes/blocks/site-title.php
/opt/homebrew/var/www/wp-includes/blocks/pattern.php
/opt/homebrew/var/www/wp-includes/blocks/comment-content.php
/opt/homebrew/var/www/wp-includes/blocks/search.php
/opt/homebrew/var/www/wp-includes/blocks/list.php
/opt/homebrew/var/www/wp-includes/blocks/navigation-submenu.php
/opt/homebrew/var/www/wp-includes/blocks/query-title.php
/opt/homebrew/var/www/wp-includes/blocks/query-pagination-numbers.php
/opt/homebrew/var/www/wp-includes/blocks/block.php
/opt/homebrew/var/www/wp-includes/blocks/avatar.php
/opt/homebrew/var/www/wp-includes/blocks/comment-date.php
/opt/homebrew/var/www/wp-includes/blocks/comment-reply-link.php
/opt/homebrew/var/www/wp-includes/blocks/calendar.php
/opt/homebrew/var/www/wp-includes/blocks/template-part.php
/opt/homebrew/var/www/wp-includes/blocks/post-author-name.php
/opt/homebrew/var/www/wp-includes/blocks/latest-comments.php
/opt/homebrew/var/www/wp-includes/blocks/media-text.php
/opt/homebrew/var/www/wp-includes/blocks/cover.php
/opt/homebrew/var/www/wp-includes/blocks/query-pagination-previous.php
/opt/homebrew/var/www/wp-includes/blocks/post-author.php
/opt/homebrew/var/www/wp-includes/blocks/comments-pagination.php
/opt/homebrew/var/www/wp-includes/blocks/widget-group.php
/opt/homebrew/var/www/wp-includes/blocks/page-list.php
/opt/homebrew/var/www/wp-includes/blocks/query.php
/opt/homebrew/var/www/wp-includes/blocks/categories.php
/opt/homebrew/var/www/wp-includes/blocks/comment-edit-link.php
/opt/homebrew/var/www/wp-includes/blocks/footnotes.php
/opt/homebrew/var/www/wp-includes/blocks/post-author-biography.php
/opt/homebrew/var/www/wp-includes/blocks/comments-pagination-numbers.php
/opt/homebrew/var/www/wp-includes/blocks/navigation-link.php
/opt/homebrew/var/www/wp-includes/blocks/tag-cloud.php
/opt/homebrew/var/www/wp-includes/blocks/post-content.php
/opt/homebrew/var/www/wp-includes/blocks/image.php
/opt/homebrew/var/www/wp-includes/blocks/navigation.php
/opt/homebrew/var/www/wp-includes/blocks/post-excerpt.php
/opt/homebrew/var/www/wp-includes/blocks/post-navigation-link.php
/opt/homebrew/var/www/wp-includes/blocks/home-link.php
/opt/homebrew/var/www/wp-includes/blocks/button.php
/opt/homebrew/var/www/wp-includes/class-feed.php
/opt/homebrew/var/www/wp-includes/class-oembed.php
/opt/homebrew/var/www/wp-includes/update.php
/opt/homebrew/var/www/wp-includes/class.wp-scripts.php
/opt/homebrew/var/www/wp-includes/feed-atom.php
/opt/homebrew/var/www/wp-includes/registration-functions.php
/opt/homebrew/var/www/wp-includes/embed-template.php
/opt/homebrew/var/www/wp-includes/class-json.php
/opt/homebrew/var/www/wp-includes/session.php
/opt/homebrew/var/www/wp-includes/feed-rdf.php
/opt/homebrew/var/www/wp-includes/block-patterns/social-links-shared-background-color.php
/opt/homebrew/var/www/wp-includes/block-patterns/query-large-title-posts.php
/opt/homebrew/var/www/wp-includes/block-patterns/query-medium-posts.php
/opt/homebrew/var/www/wp-includes/block-patterns/query-standard-posts.php
/opt/homebrew/var/www/wp-includes/block-patterns/query-offset-posts.php
/opt/homebrew/var/www/wp-includes/block-patterns/query-grid-posts.php
/opt/homebrew/var/www/wp-includes/block-patterns/query-small-posts.php
/opt/homebrew/var/www/wp-includes/class-http.php
/opt/homebrew/var/www/wp-includes/feed-atom-comments.php
/opt/homebrew/var/www/wp-includes/block-supports/settings.php
/opt/homebrew/var/www/wp-includes/block-supports/dimensions.php
/opt/homebrew/var/www/wp-includes/block-supports/layout.php
/opt/homebrew/var/www/wp-includes/block-supports/elements.php
/opt/homebrew/var/www/wp-includes/theme-compat/embed-content.php
/opt/homebrew/var/www/wp-includes/theme-compat/comments.php
/opt/homebrew/var/www/wp-includes/theme-compat/footer-embed.php
/opt/homebrew/var/www/wp-includes/theme-compat/embed.php
/opt/homebrew/var/www/wp-includes/theme-compat/header.php
/opt/homebrew/var/www/wp-includes/theme-compat/footer.php
/opt/homebrew/var/www/wp-includes/theme-compat/header-embed.php
/opt/homebrew/var/www/wp-includes/theme-compat/sidebar.php
/opt/homebrew/var/www/wp-includes/theme-compat/embed-404.php
/opt/homebrew/var/www/wp-includes/template-canvas.php
/opt/homebrew/var/www/wp-includes/ms-default-filters.php
/opt/homebrew/var/www/wp-includes/feed-rss2-comments.php
/opt/homebrew/var/www/wp-includes/feed-rss.php
/opt/homebrew/var/www/wp-includes/vars.php
/opt/homebrew/var/www/wp-includes/template-loader.php
/opt/homebrew/var/www/wp-includes/class.wp-dependencies.php
/opt/homebrew/var/www/wp-includes/date.php
/opt/homebrew/var/www/wp-includes/block-bindings/post-meta.php
/opt/homebrew/var/www/wp-includes/block-bindings/pattern-overrides.php
/opt/homebrew/var/www/wp-includes/class-snoopy.php
/opt/homebrew/var/www/wp-includes/default-filters.php
/opt/homebrew/var/www/wp-includes/spl-autoload-compat.php
/opt/homebrew/var/www/wp-includes/class-smtp.php
/opt/homebrew/var/www/wp-includes/class.wp-styles.php
/opt/homebrew/var/www/wp-includes/media.php
/opt/homebrew/var/www/wp-includes/registration.php
/opt/homebrew/var/www/wp-includes/feed-rss2.php
/opt/homebrew/var/www/wp-includes/block-patterns.php
/opt/homebrew/var/www/wp-includes/class-wp-feed-cache.php
/opt/homebrew/var/www/wp-includes/locale.php
/opt/homebrew/var/www/wp-includes/customize/class-wp-customize-new-menu-control.php
/opt/homebrew/var/www/wp-includes/customize/class-wp-customize-new-menu-section.php
/opt/homebrew/var/www/wp-content/plugins/hello.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/functions.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/testimonials-2-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/page-link-in-bio-heading-paragraph-links-image.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-query-loop-text-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/cta-book-locations.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/heading-and-paragraph-with-image.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/page-link-in-bio-wide-margins.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/grid-videos.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-home-with-sidebar-news-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/more-posts.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-single-vertical-header-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/media-instagram-grid.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/page-coming-soon.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hidden-blog-heading.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/text-faqs.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/cta-events-list.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hero-overlapped-book-cover-with-links.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hidden-search.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/page-portfolio-home.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/format-link.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/event-schedule.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/banner-cover-big-heading.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-home-news-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/format-audio.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/post-navigation.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/comments.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/services-3-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/cta-book-links.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/services-subscriber-only-section.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-query-loop-vertical-header-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/testimonials-large.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/banner-about-book.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/footer-centered.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-query-loop.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/event-3-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-single-news-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/cta-grid-products-link.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hero-full-width-image.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hidden-404.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/pricing-2-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/footer-newsletter.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-home-photo-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/overlapped-images.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/logos.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hidden-sidebar.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/footer-social.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/page-link-in-bio-with-tight-margins.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/banner-poster.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/cta-heading-search.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-single-text-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/footer.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/banner-intro.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-single-left-aligned-content.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/contact-info-locations.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/pricing-3-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-query-loop-news-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/contact-centered-social-link.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-single-photo-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/testimonials-6-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/banner-with-description-and-images-grid.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hero-book.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/contact-location-and-link.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-query-loop-photo-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/banner-intro-image.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/page-cv-bio.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/services-team-photos.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hero-podcast.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/grid-with-categories.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/hidden-written-by.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-home-posts-grid-news-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/event-rsvp.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-home-text-blog.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/cta-newsletter.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/template-single-offset.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/cta-centered-heading.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfive/patterns/footer-columns.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/functions.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/text-centered-statement-small.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/template-index-blogging.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/cta-subscribe-centered.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/gallery-full-screen-image.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/banner-project-description.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-search.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/text-feature-grid-3-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/cta-services-image-left.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/gallery-project-layout.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/text-alternating-images.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/cta-content-image-on-right.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/cta-rsvp.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/page-rsvp-landing.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/template-index-portfolio.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/text-title-left-image-right.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-post-navigation.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-comments.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-404.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/page-newsletter-landing.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/team-4-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/cta-pricing.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/text-faq.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/text-centered-statement.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-sidebar.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/posts-list.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/text-project-details.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/footer-colophon-3-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/footer.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/banner-hero.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/posts-grid-2-col.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-posts-heading.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-post-meta.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-no-results.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/testimonial-centered.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/hidden-portfolio-hero.php
/opt/homebrew/var/www/wp-content/themes/twentytwentyfour/patterns/footer-centered-logo-nav.php
/opt/homebrew/var/www/wp-content/themes/twentytwentythree/patterns/hidden-heading.php
/opt/homebrew/var/www/wp-content/themes/twentytwentythree/patterns/hidden-comments.php
/opt/homebrew/var/www/wp-content/themes/twentytwentythree/patterns/footer-default.php
/opt/homebrew/var/www/wp-content/themes/twentytwentythree/patterns/hidden-404.php
/opt/homebrew/var/www/wp-content/themes/twentytwentythree/patterns/post-meta.php
/opt/homebrew/var/www/wp-content/themes/twentytwentythree/patterns/call-to-action.php
/opt/homebrew/var/www/wp-content/themes/twentytwentythree/patterns/hidden-no-results.php

[bor0]

The attached file looks to address all the "Call to undefined function" issues.

$ patch -p0 < ~/Desktop/62724.patch
patching file 'wp-admin/admin-functions.php'
patching file 'wp-admin/admin-header.php'
patching file 'wp-admin/custom-background.php'
patching file 'wp-admin/custom-header.php'
patching file 'wp-admin/includes/admin-filters.php'
patching file 'wp-admin/includes/admin.php'
patching file 'wp-admin/includes/class-wp-upgrader-skins.php'
patching file 'wp-admin/includes/continents-cities.php'
patching file 'wp-admin/includes/edit-tag-messages.php'
patching file 'wp-admin/includes/file.php'
patching file 'wp-admin/includes/menu.php'
patching file 'wp-admin/includes/ms-admin-filters.php'
patching file 'wp-admin/menu-header.php'
patching file 'wp-admin/menu.php'
patching file 'wp-admin/network/menu.php'
patching file 'wp-admin/options-head.php'
patching file 'wp-admin/upgrade-functions.php'
patching file 'wp-admin/user/menu.php'
patching file 'wp-content/plugins/hello.php'
patching file 'wp-content/themes/twentytwentyfive/functions.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/banner-about-book.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/banner-cover-big-heading.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/banner-intro-image.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/banner-intro.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/banner-poster.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/banner-with-description-and-images-grid.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/comments.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/contact-centered-social-link.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/contact-info-locations.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/contact-location-and-link.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/cta-book-links.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/cta-book-locations.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/cta-centered-heading.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/cta-events-list.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/cta-grid-products-link.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/cta-heading-search.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/cta-newsletter.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/event-3-col.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/event-rsvp.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/event-schedule.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/footer-centered.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/footer-columns.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/footer-newsletter.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/footer-social.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/footer.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/format-audio.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/format-link.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/grid-videos.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/grid-with-categories.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/heading-and-paragraph-with-image.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hero-book.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hero-full-width-image.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hero-overlapped-book-cover-with-links.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hero-podcast.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hidden-404.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hidden-blog-heading.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hidden-search.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hidden-sidebar.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/hidden-written-by.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/logos.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/media-instagram-grid.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/more-posts.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/overlapped-images.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/page-coming-soon.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/page-cv-bio.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/page-link-in-bio-heading-paragraph-links-image.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/page-link-in-bio-wide-margins.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/page-link-in-bio-with-tight-margins.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/page-portfolio-home.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/post-navigation.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/pricing-2-col.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/pricing-3-col.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/services-3-col.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/services-subscriber-only-section.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/services-team-photos.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-home-news-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-home-photo-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-home-posts-grid-news-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-home-text-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-home-with-sidebar-news-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-query-loop-news-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-query-loop-photo-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-query-loop-text-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-query-loop-vertical-header-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-query-loop.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-single-left-aligned-content.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-single-news-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-single-offset.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-single-photo-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-single-text-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/template-single-vertical-header-blog.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/testimonials-2-col.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/testimonials-6-col.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/testimonials-large.php'
patching file 'wp-content/themes/twentytwentyfive/patterns/text-faqs.php'
patching file 'wp-content/themes/twentytwentyfour/functions.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/banner-hero.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/banner-project-description.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/cta-content-image-on-right.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/cta-pricing.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/cta-rsvp.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/cta-services-image-left.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/cta-subscribe-centered.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/footer-centered-logo-nav.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/footer-colophon-3-col.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/footer.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/gallery-full-screen-image.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/gallery-project-layout.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-404.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-comments.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-no-results.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-portfolio-hero.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-post-meta.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-post-navigation.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-posts-heading.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-search.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/hidden-sidebar.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/page-newsletter-landing.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/page-rsvp-landing.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/posts-grid-2-col.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/posts-list.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/team-4-col.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/template-index-blogging.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/template-index-portfolio.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/testimonial-centered.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/text-alternating-images.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/text-centered-statement-small.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/text-centered-statement.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/text-faq.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/text-feature-grid-3-col.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/text-project-details.php'
patching file 'wp-content/themes/twentytwentyfour/patterns/text-title-left-image-right.php'
patching file 'wp-content/themes/twentytwentythree/patterns/call-to-action.php'
patching file 'wp-content/themes/twentytwentythree/patterns/footer-default.php'
patching file 'wp-content/themes/twentytwentythree/patterns/hidden-404.php'
patching file 'wp-content/themes/twentytwentythree/patterns/hidden-comments.php'
patching file 'wp-content/themes/twentytwentythree/patterns/hidden-heading.php'
patching file 'wp-content/themes/twentytwentythree/patterns/hidden-no-results.php'
patching file 'wp-content/themes/twentytwentythree/patterns/post-meta.php'
patching file 'wp-includes/block-bindings/pattern-overrides.php'
patching file 'wp-includes/block-bindings/post-meta.php'
patching file 'wp-includes/block-patterns/query-grid-posts.php'
patching file 'wp-includes/block-patterns/query-large-title-posts.php'
patching file 'wp-includes/block-patterns/query-medium-posts.php'
patching file 'wp-includes/block-patterns/query-offset-posts.php'
patching file 'wp-includes/block-patterns/query-small-posts.php'
patching file 'wp-includes/block-patterns/query-standard-posts.php'
patching file 'wp-includes/block-patterns/social-links-shared-background-color.php'
patching file 'wp-includes/block-patterns.php'
patching file 'wp-includes/block-supports/dimensions.php'
patching file 'wp-includes/block-supports/elements.php'
patching file 'wp-includes/block-supports/layout.php'
patching file 'wp-includes/block-supports/settings.php'
patching file 'wp-includes/blocks/archives.php'
patching file 'wp-includes/blocks/avatar.php'
patching file 'wp-includes/blocks/block.php'
patching file 'wp-includes/blocks/button.php'
patching file 'wp-includes/blocks/calendar.php'
patching file 'wp-includes/blocks/categories.php'
patching file 'wp-includes/blocks/comment-author-name.php'
patching file 'wp-includes/blocks/comment-content.php'
patching file 'wp-includes/blocks/comment-date.php'
patching file 'wp-includes/blocks/comment-edit-link.php'
patching file 'wp-includes/blocks/comment-reply-link.php'
patching file 'wp-includes/blocks/comment-template.php'
patching file 'wp-includes/blocks/comments-pagination-next.php'
patching file 'wp-includes/blocks/comments-pagination-numbers.php'
patching file 'wp-includes/blocks/comments-pagination-previous.php'
patching file 'wp-includes/blocks/comments-pagination.php'
patching file 'wp-includes/blocks/comments-title.php'
patching file 'wp-includes/blocks/comments.php'
patching file 'wp-includes/blocks/cover.php'
patching file 'wp-includes/blocks/file.php'
patching file 'wp-includes/blocks/footnotes.php'
patching file 'wp-includes/blocks/gallery.php'
patching file 'wp-includes/blocks/heading.php'
patching file 'wp-includes/blocks/home-link.php'
patching file 'wp-includes/blocks/image.php'
patching file 'wp-includes/blocks/latest-comments.php'
patching file 'wp-includes/blocks/latest-posts.php'
patching file 'wp-includes/blocks/legacy-widget.php'
patching file 'wp-includes/blocks/list.php'
patching file 'wp-includes/blocks/loginout.php'
patching file 'wp-includes/blocks/media-text.php'
patching file 'wp-includes/blocks/navigation-link.php'
patching file 'wp-includes/blocks/navigation-submenu.php'
patching file 'wp-includes/blocks/navigation.php'
patching file 'wp-includes/blocks/page-list-item.php'
patching file 'wp-includes/blocks/page-list.php'
patching file 'wp-includes/blocks/pattern.php'
patching file 'wp-includes/blocks/post-author-biography.php'
patching file 'wp-includes/blocks/post-author-name.php'
patching file 'wp-includes/blocks/post-author.php'
patching file 'wp-includes/blocks/post-comments-form.php'
patching file 'wp-includes/blocks/post-content.php'
patching file 'wp-includes/blocks/post-date.php'
patching file 'wp-includes/blocks/post-excerpt.php'
patching file 'wp-includes/blocks/post-featured-image.php'
patching file 'wp-includes/blocks/post-navigation-link.php'
patching file 'wp-includes/blocks/post-template.php'
patching file 'wp-includes/blocks/post-terms.php'
patching file 'wp-includes/blocks/post-title.php'
patching file 'wp-includes/blocks/query-no-results.php'
patching file 'wp-includes/blocks/query-pagination-next.php'
patching file 'wp-includes/blocks/query-pagination-numbers.php'
patching file 'wp-includes/blocks/query-pagination-previous.php'
patching file 'wp-includes/blocks/query-pagination.php'
patching file 'wp-includes/blocks/query-title.php'
patching file 'wp-includes/blocks/query.php'
patching file 'wp-includes/blocks/read-more.php'
patching file 'wp-includes/blocks/rss.php'
patching file 'wp-includes/blocks/search.php'
patching file 'wp-includes/blocks/shortcode.php'
patching file 'wp-includes/blocks/site-logo.php'
patching file 'wp-includes/blocks/site-tagline.php'
patching file 'wp-includes/blocks/site-title.php'
patching file 'wp-includes/blocks/social-link.php'
patching file 'wp-includes/blocks/tag-cloud.php'
patching file 'wp-includes/blocks/template-part.php'
patching file 'wp-includes/blocks/term-description.php'
patching file 'wp-includes/blocks/widget-group.php'
patching file 'wp-includes/class-feed.php'
patching file 'wp-includes/class-http.php'
patching file 'wp-includes/class-json.php'
patching file 'wp-includes/class-oembed.php'
patching file 'wp-includes/class-smtp.php'
patching file 'wp-includes/class-snoopy.php'
patching file 'wp-includes/class-wp-feed-cache.php'
patching file 'wp-includes/class.wp-dependencies.php'
patching file 'wp-includes/class.wp-scripts.php'
patching file 'wp-includes/class.wp-styles.php'
patching file 'wp-includes/customize/class-wp-customize-new-menu-control.php'
patching file 'wp-includes/customize/class-wp-customize-new-menu-section.php'
patching file 'wp-includes/date.php'
patching file 'wp-includes/default-filters.php'
patching file 'wp-includes/embed-template.php'
patching file 'wp-includes/feed-atom-comments.php'
patching file 'wp-includes/feed-atom.php'
patching file 'wp-includes/feed-rdf.php'
patching file 'wp-includes/feed-rss.php'
patching file 'wp-includes/feed-rss2-comments.php'
patching file 'wp-includes/feed-rss2.php'
patching file 'wp-includes/locale.php'
patching file 'wp-includes/media.php'
patching file 'wp-includes/ms-default-filters.php'
patching file 'wp-includes/registration-functions.php'
patching file 'wp-includes/registration.php'
patching file 'wp-includes/rss.php'
patching file 'wp-includes/session.php'
patching file 'wp-includes/spl-autoload-compat.php'
patching file 'wp-includes/template-canvas.php'
patching file 'wp-includes/template-loader.php'
patching file 'wp-includes/theme-compat/comments.php'
patching file 'wp-includes/theme-compat/embed-404.php'
patching file 'wp-includes/theme-compat/embed-content.php'
patching file 'wp-includes/theme-compat/embed.php'
patching file 'wp-includes/theme-compat/footer-embed.php'
patching file 'wp-includes/theme-compat/footer.php'
patching file 'wp-includes/theme-compat/header-embed.php'
patching file 'wp-includes/theme-compat/header.php'
patching file 'wp-includes/theme-compat/sidebar.php'
patching file 'wp-includes/update.php'
patching file 'wp-includes/vars.php'
$ > ~/dev/log/error_log # empty error log
$ find . -name '*.php' | sed 's|^\./||' | xargs -I {} echo "http://localhost:8080/{}" > urls.txt # generate urls
$ xargs -P 10 -n 1 curl -s -o /dev/null < urls.txt # visit each url
$ grep "Call to undefined function" ~/dev/log/error_log | grep -o '/[^ ]*.php' | uniq
$ patch -p0 -R < ~/Desktop/test.patch
$

That is, after applying the patch, no "Call to undefined function" errors are reported.

cc @SergeyBiryukov another one for your attention, would be greatly appreciated :)

[bor0]

Adding ABSPATH check makes sense for these files because all the functions are WP related functions:

Call to undefined function __()
Call to undefined function _deprecated_file()
Call to undefined function _e()
Call to undefined function _x()
Call to undefined function add_action()
Call to undefined function add_filter()
Call to undefined function add_shortcode()
Call to undefined function add_theme_support()
Call to undefined function apply_filters()
Call to undefined function do_action()
Call to undefined function esc_attr_e()
Call to undefined function esc_attr_x()
Call to undefined function esc_html__()
Call to undefined function esc_html_e()
Call to undefined function esc_html_x()
Call to undefined function esc_url()
Call to undefined function feed_content_type()
Call to undefined function get_header()
Call to undefined function get_locale()
Call to undefined function get_option()
Call to undefined function get_the_block_template_html()
Call to undefined function is_admin()
Call to undefined function is_main_site()
Call to undefined function is_network_admin()
Call to undefined function language_attributes()
Call to undefined function post_class()
Call to undefined function settings_errors()
Call to undefined function wp_kses_post()
Call to undefined function wp_using_themes()

[swissspidy]

This has come up a few times before, for example in #36177, #30806, #44700, #45773, #48049, or #53271

Per the ​Security FAQ, these errors are considered a server configuration issue rather than a security issue:

Why are there path disclosures when directly loading certain files?
This is a server configuration problem. Never enable display_errors on a production site.

Instead of changing all PHP files to add a check for ABSPATH, this should be done in a central location, which is being discussed in #36177.

Let's continue the discussion in that ticket, as it would be best to keep all discussion on the general idea of "blocking malicious requests" in a single place, even if any implemented change does not necessarily follow how the ticket originally intended on it being implemented.

That said, it looks like this ticket is more about unnecessary error logging rather than a path disclosure. Still, blocking direct access to the files in question using the web server configuration file should resolve the issue for now, until any changes are implemented in core.

See also a related similar ticket for bundled themes: #47154.

[swissspidy]

Duplicate of #36177.

[bor0]

@swissspidy what's the ETA of that issue? It seems like it's 9 years old. Would this not work as an interim solution while that one is being discussed?

it looks like this ticket is more about unnecessary error logging rather than a path disclosure

Unnecessary error logging can also be abused - e.g., we have Slack alerts for PHP errors, and there is a lot of noise for us there, we cannot distinguish from actual errors and noisy errors.

[bor0]

these errors are considered a server configuration issue rather than a security issue

Also, we already have these checks in some files, so I'd say at least this will improve consistency there.

I think the number of tickets reported for this show a strong signal, so instead of closing them as "duplicate of a [many-years-old issue]", we should try to fix it in a way that it works for all users out-of-the-box, without them having to tackle .htaccess or error_reporting