Include path risk
-
Hello!
The main plugin file executes some
include()statements without a directory specified. The danger is that the included files will first be looked for in the current working directory (depends on the configuration, but apparently many systems have “.” as the first entry in theirinclude_path). This caused an issue for me where the themefunctions.phpran too early, because I usedwp-clifrom the theme directory.The safe way would be to specify the exact directory of the file to be included, using PHP constant
__DIR__orplugin_dir_path(__FILE__)!The issue can be reproduced in some ways:
– Usewp-clifrom your theme folder. If yourfunctions.phpuses Woocommerce code it will crash, because WC is loaded after woocommerce-email-test.
– Place afunctions.php(oremail-trigger.php) in your website root, now the plugin will load this file instead of its own when used normally from a browser!
The topic ‘Include path risk’ is closed to new replies.