No worries; at least as far as I am concerned, these kinds of discussions are absolutely appropriate for this mailing list.<div><br></div><div><b>I would say that, at current, the Guidelines are silent on the matter.</b> </div>
<div><br></div><div>There are security best-practice arguments to be made to ensure that template-part files cannot be loaded directly, and we should probably put something in place with respect to those best practices.</div>
<div><br></div><div>On the other hand, the specific implementation you referenced, as written, does not pose a security risk. There may be other/better ways to do it, or that way may be the best way.</div><div><br></div><div>
(How's that for equivocation? :) )</div><div><br></div><div>If anyone would like to suggest best practices in this area, this would be a great place to do so!</div><div><br></div><div>Chip<br><br><div class="gmail_quote">
On Mon, Sep 26, 2011 at 4:10 PM, Tyler Cunningham <span dir="ltr"><<a href="mailto:seizedpropaganda@gmail.com">seizedpropaganda@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
Sorry to resurrect this thread but is the consensus now that this line does not need to be removed? I apologize if I submitted faulty information before, I was simply going off what I witnessed another reviewer marking as required in their reviews (which is when I started doing it myself). I am getting the impression that this line does not need to be removed like I originally thought, am I correct in that assumption?
</div><div><br></div><div>Thanks. </div><div class="im">
<div><br>
<span style="font-family:Arial;font-size:medium"><span style="border-collapse:separate;color:rgb(0, 0, 0);font-family:Times;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;font-size:medium"><span style="font-family:Helvetica;font-size:13px"><span>Regards,</span><span><br>
<br></span></span></span></span><div style="font-size:medium;font-family:Arial"><span>Tyler Cunningham | Founder, COO - <a href="http://CyberChimps.com/" style="color:rgb(0, 58, 138)" target="_blank">CyberChimps LLC</a></span></div>
<div style="font-size:medium;font-family:Arial"><span><br></span></div><div style="font-size:medium;font-family:Arial"><span><a href="http://twitter.com/tylerbcunning" target="_blank">@tylerbcunning</a></span></div><div style="font-size:medium;font-family:Arial">
<span><a href="http://gplus.to/tylercunningham" target="_blank">http://gplus.to/tylercunningham</a></span></div><div style="font-size:medium;font-family:Arial"><span><a href="http://linkedin.com/in/tylerbcunningham" style="color:rgb(0, 58, 138)" target="_blank">http://linkedin.com/in/tylerbcunningham</a> </span></div>
<div style="font-size:medium;font-family:Arial"><span><a href="mailto:tyler@cyberchimps.com" style="color:rgb(0, 58, 138)" target="_blank">tyler@cyberchimps.com</a></span></div><br></div>
</div><div><div></div><div class="h5"><p style="color:#A0A0A8">On Sunday, September 25, 2011 at 2:40 AM, Mike Little wrote:</p>
</div></div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px">
<span><div><div><div></div><div class="h5"><div>Oops, accidently pressed send...<div><br></div><div><span style="color:rgb(34, 34, 34);font-family:arial, sans-serif;font-size:13px;background-color:rgb(255, 255, 255)"><div>
This line has also been in every version of WordPress since 0.7 </div>
<div>Historically, the file wp-comments.php used to be in the root of the WordPress directory (i.e. in the same place as wp-config.php.</div><div><br></div><div>And was probably instigated as it was one of the few files that would produce output if requested directly. The line protects against that.</div>
<div><br></div><div>Even when the theme files moved into their own directory in 1.5 the default (Kubrick), copeid the same code. Intrerestingly, classic dropped it.</div></span><font color="#222222" face="arial, sans-serif"><br>
<span style="font-size:14px;background-color:rgb(255, 255, 255)">In reality we should be cautious of any files that can produce output if requested directly, especially if they might produce errors. As this can be a source of information leak, and thus indirectly a security risk.</span><br>
</font><span style="color:rgb(34, 34, 34);font-family:arial, sans-serif;font-size:13px;background-color:rgb(255, 255, 255)"><div><br></div><div>Mike</div></span>-- <br>Mike Little<div><a href="http://zed1.com/" target="_blank">http://zed1.com/</a></div>
<div><br></div><br>
</div>
</div></div></div><div class="im"><div>_______________________________________________<br>theme-reviewers mailing list<br><a href="mailto:theme-reviewers@lists.wordpress.org" target="_blank">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br></div></div></div></span>
</blockquote>
<div>
<br>
</div>
<br>_______________________________________________<br>
theme-reviewers mailing list<br>
<a href="mailto:theme-reviewers@lists.wordpress.org">theme-reviewers@lists.wordpress.org</a><br>
<a href="http://lists.wordpress.org/mailman/listinfo/theme-reviewers" target="_blank">http://lists.wordpress.org/mailman/listinfo/theme-reviewers</a><br>
<br></blockquote></div><br></div>