From e320a48146b1d80f6a39badedfcb69067c972241 Mon Sep 17 00:00:00 2001 From: Dion Hulse Date: Fri, 30 Aug 2013 07:34:24 +0000 Subject: [PATCH] Theme Upgrader: Be super-careful and check the contents of the $wp_theme_directories variable before merging it, if someone has changed it directly, or worse, unset it, this could've resulted in the $protected_directories being empty. See [25082] See #22501 git-svn-id: https://develop.svn.wordpress.org/trunk@25180 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/includes/class-wp-upgrader.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/wp-admin/includes/class-wp-upgrader.php b/src/wp-admin/includes/class-wp-upgrader.php index 1bd33ed826..7ceda137f9 100644 --- a/src/wp-admin/includes/class-wp-upgrader.php +++ b/src/wp-admin/includes/class-wp-upgrader.php @@ -212,7 +212,10 @@ class WP_Upgrader { // Protection against deleting files in any important base directories. // Theme_Upgrader & Plugin_Upgrader also trigger this, as they pass the destination directory (WP_PLUGIN_DIR / wp-content/themes) // intending to copy the directory into the directory, whilst they pass the source as the actual files to copy. - if ( in_array( $destination, array_merge( array( ABSPATH, WP_CONTENT_DIR, WP_PLUGIN_DIR, WP_CONTENT_DIR . '/themes' ), $wp_theme_directories ) ) ) { + $protected_directories = array( ABSPATH, WP_CONTENT_DIR, WP_PLUGIN_DIR, WP_CONTENT_DIR . '/themes' ); + if ( is_array( $wp_theme_directories ) ) + $protected_directories = array_merge( $protected_directories, $wp_theme_directories ); + if ( in_array( $destination, $protected_directories ) ) { $remote_destination = trailingslashit($remote_destination) . trailingslashit(basename($source)); $destination = trailingslashit($destination) . trailingslashit(basename($source)); }