WordPress.org

Make WordPress Core

Opened 6 years ago

Closed 6 years ago

#7417 closed defect (bug) (fixed)

Theme preview fails when Theme forlder contain "."(dot)

Reported by: supremecolor Owned by:
Milestone: 2.6.1 Priority: normal
Severity: normal Version: 2.6
Component: Template Keywords: theme, preview
Focuses: Cc:

Description

If the theme directory's name has dot(.) in it, the admin theme preview will show blank page.

for example, rename the default theme directory to "defau.lt", and click to preview the theme in admin area, it shows blank page.

Change History (3)

comment:1 mrmist6 years ago

Confirming this (with 2.6)

I'm not really sure why anyone would want to have a directory with a . in it, and I expect that there may be some security implications in it.

That said, since the theme itself works regardless of the . then the preview image should work, too.

comment:2 santosj6 years ago

  • Milestone set to 2.7

Security? The exploit I can think of is '../../../to/public/folder/with/whatever/'. Periods are legal in folder names. '../' Should be stripped, not '.'.

comment:3 ryan6 years ago

  • Milestone changed from 2.7 to 2.6.1
  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.