Skip to content

Conversation

bobbingwide
Copy link
Contributor

Description

In gutenberg_render_block_core_template_part when trying to find the template part from the theme's files, rather than calling validate_file() against the full file name, we just validate the slug part. This overcomes the problem that in a Windows server the return code is 2 when the file name contains the drive letter ( eg C: ).

How has this been tested?

  • Tested in a WordPress Multi Site environment with the TwentyTwenty-One Blocks theme.
  • Only active plugin Gutenberg
  • Not tested

Screenshots

  • Without the fix the Template Part Not Found message is displayed twice.
    image

  • With the fix the header and footer templates are found.

image

Types of changes

Bug fix for #26010. This only fixes the problem as reported.

It does not improve on the message "Template Part Not Found".
That's for later.

Checklist:

  • My code is tested.
  • My code follows the WordPress code style.
  • My code follows the accessibility standards.
  • My code has proper inline documentation.
  • I've included developer documentation if appropriate.
  • I've updated all React Native files affected by any refactorings/renamings in this PR.

@@ -40,7 +40,7 @@ function render_block_core_template_part( $attributes ) {
// Else, if the template part was provided by the active theme,
// render the corresponding file content.
$template_part_file_path = get_stylesheet_directory() . '/block-template-parts/' . $attributes['slug'] . '.html';
if ( 0 === validate_file( $template_part_file_path ) && file_exists( $template_part_file_path ) ) {
if ( 0 === validate_file( $attributes['slug'] ) && file_exists( $template_part_file_path ) ) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know what's the purpose of this validate_file call? Why not just remove it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's to stop directory traversal.

Copy link
Contributor

@youknowriad youknowriad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for being patient here even for a small change. I appreciate it.

@youknowriad youknowriad merged commit b46effd into WordPress:master Nov 26, 2020
@github-actions github-actions bot added this to the Gutenberg 9.5 milestone Nov 26, 2020
@bobbingwide bobbingwide deleted the gutenberg-source/fix/26010 branch November 26, 2020 09:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[Type] Bug An existing feature does not function as intended
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants