Comments (12)
What is a legit use for it?
Drop-in libraries often need it for finding correct paths and so on.
The real question though is why discourage the use in the first place? Is there are particular issue? If so, we should address those specifically.
from wpthemereview.
Consistency. Can drop-in libraries not use core paths?
Some drop-ins are used in plugins and themes.
from wpthemereview.
This path should not be used period and in combination with anything theme
related.
I would agree for the rule only if we generalize it.
On Tuesday, July 12, 2016, Juliette [email protected] wrote:
Decision needed by Theme Review Board:
There is currently no rule to check for the use of FILE in combinaion
with add_theme_page() which could lead to full path disclosure..There is already a sniff available in WPCS which will check this -
WordPress.VIP.PluginMenuSlug.Should this sniff be activated for theme reviews ?
Advice: Follow WP VIP's lead in this.
To do:
- If agreed this should be a rule - add WordPress.VIP.PluginMenuSlug
sniff to the ruleset.- Add the rule in the Theme Review handbook to the Requirements page.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#18, or mute
the thread
https://github.com/notifications/unsubscribe/ABs6zo3ot50cL6yfxX9DxL6yDgq8DTKvks5qU5qzgaJpZM4JKaSy
.
from wpthemereview.
@emiluzelac We can cover not allowing __FILE__
completly in another sniff. #23 I would lean to allow this for now till the other sniff has been implimented.
from wpthemereview.
I disagree to a generalized rule on __FILE__
. The above, specific rule that addresses a specific issue is what we need to go for. When you make generalized checks, you throw out any legit use cases.
It's like the whole wp_deregister_script()
in #21. Blocking wp_deregister_script()
altogether throws out legit use cases instead of addressing the actual problem of wp_deregister_script( 'jquery' )
.
from wpthemereview.
What is a legit use for it?
On Friday, July 15, 2016, Justin Tadlock [email protected] wrote:
I disagree to a generalized rule on FILE. The above, specific rule
that addresses a specific issue is what we need to go for. When you make
generalized checks, you throw out any legit use cases.—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#18 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABs6zss88pilfYVSv5W3GN4VJDgVLkjyks5qV48hgaJpZM4JKaSy
.
from wpthemereview.
I use a theme that uses __FILE__
for a template trace when in debug mode, so you can see which template files were used to create the final page. That's very helpful when writing a child theme.
from wpthemereview.
Consistency. Can drop-in libraries not use core paths?
On Fri, Jul 15, 2016 at 3:15 PM, Justin Tadlock [email protected]
wrote:
What is a legit use for it?
Drop-in libraries often need it for finding correct paths and so on.
The real question though is why discourage the use in the first place? Is
there are particular issue? If so, we should address those specifically.—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#18 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ABs6zs6nXPam2ixPmWvMlw27GEqhSLDzks5qV-pygaJpZM4JKaSy
.
from wpthemereview.
Is there are particular issue? If so, we should address those specifically.
And in this case there is a particular issue this would address, see the original issue description above.
from wpthemereview.
That makes sense @Pross, thanks :)
from wpthemereview.
As the sniff prevents a security issue I am going to add the check.
from wpthemereview.
PR #19 merged...
from wpthemereview.
Related Issues (20)
- variables in template files are flagged as global HOT 15
- Exceptions to prefixing hook names HOT 7
- False positive on loading stylesheet in JS file HOT 4
- [New sniff] WC template versions HOT 7
- Dealing with rules that shouldn't apply to templates HOT 1
- Add sniff: WordPress.PHP.IniSet HOT 6
- [New sniff] Check if page templates are using reserved prefix HOT 1
- Detect WPTRT feature project versions HOT 3
- Add sniff documentation HOT 1
- Minimal PHP version HOT 11
- Whitelist wp_body_open function from PrefixAllGlobals sniff HOT 5
- sniff: plugin territory - action hook wp_edit_nav_menu_walker
- File name with reserved slug in subfolder HOT 11
- Optimisation and minor grammar fixes
- [Implement sniff] Warn about short ternary usage in themes HOT 9
- Internal.Exception -- function update_current_version() should be removed.
- [Update existing sniff] Allow register_block_style HOT 1
- Allow `add_menu_page` & `add_submenu_page` HOT 9
- twentyseventeen theme: posts with no date - but date is shown in similar posts HOT 1
- 👍
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wpthemereview.