Support » Fixing WordPress » Ajax Update theme error with slug contain slash

  • Hello,

    With ajax update theme the theme slug in post request is sanitized with wp_unslash and then the slash contain in the slug is removed.

    With the global WordPress Updates page the request update-core.php?action=do-theme-upgrade work fine.

    The theme roots sage (https://github.com/roots/sage) chane the default directory of the style.css so the stylesheet and theme option is saved in db like so ‘sage/resources’.

    Why the slash is removed with the update theme ajax?

    file: wp-admin/includes/ajax-actions.php, line: 4114

    • This topic was modified 4 years, 1 month ago by redcastor.
Viewing 5 replies - 1 through 5 (of 5 total)
  • Moderator bcworkz

    (@bcworkz)

    It’s customary to unslash all data from $_POST, which comes through with escaped slashes but typically would confuse the handling of strings where unslashed data is expected. Only backslashes added in a prior escaping process are stripped, not the forward slash used in *nix paths. If any data originally contained a backslash, it would have become a double backslash when escaped, such that when unslashed the original remains intact.

    Thread Starter redcastor

    (@redcastor)

    Hello,

    Yes it’s right for wp_unslash but on the line 4114 the regular expression strip forward slash

    $stylesheet = preg_replace( '/[^A-z0-9_\-]/', '', wp_unslash( $_POST['slug'] ) );

    The function wp_get_theme called by ajax request on update theme accepted param stylesheet and this function create a instance of class WP_Theme with first param stylesheet but the first param of the class WP_Theme is describe to accepted directory (https://developer.wordpress.org/reference/classes/wp_theme/__construct/)

    So why is the forward slash removed?
    This is confusing.

    Moderator bcworkz

    (@bcworkz)

    Slugs can only contain the characters A-z0-9_-. Any slash in a slug is inappropriate.

    Thread Starter redcastor

    (@redcastor)

    Yes a slug cannot contain a slash or other special character.
    But in this case it is not a slug it is a stylesheet so it is a directory and directory can contains forward slash.

    Moderator bcworkz

    (@bcworkz)

    I see. Sorry, I’ve had “theme slug” from the OP lurking in my head 🙂 We shouldn’t be moving style.css from where it belongs. We can leave it empty (except the header comment) and enqueue whatever other stylesheets in theme subfolders, but style.css belongs in in the root theme folder. Thus the other enqueued sheets can act like alternative default stylesheets, but style.css stays where it belongs.

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Ajax Update theme error with slug contain slash’ is closed to new replies.