Include path risk
-
Hello!
The main plugin file executes some
include()
statements without a directory specified. The danger is that the included files will first be looked for in the current working directory (depends on the configuration, but apparently many systems have “.” as the first entry in theirinclude_path
). This caused an issue for me where the themefunctions.php
ran too early, because I usedwp-cli
from the theme directory.The safe way would be to specify the exact directory of the file to be included, using PHP constant
__DIR__
orplugin_dir_path(__FILE__)
!The issue can be reproduced in some ways:
– Usewp-cli
from your theme folder. If yourfunctions.php
uses Woocommerce code it will crash, because WC is loaded after woocommerce-email-test.
– Place afunctions.php
(oremail-trigger.php
) in your website root, now the plugin will load this file instead of its own when used normally from a browser!
- The topic ‘Include path risk’ is closed to new replies.