[wp-trac] [WordPress Trac] #28246: Permalink Options page throws errors on Windows

[WordPress Trac]

#28246: Permalink Options page throws errors on Windows
----------------------------+-----------------------------
 Reporter:  pkmnfrk         |      Owner:
     Type:  defect (bug)    |     Status:  new
 Priority:  normal          |  Milestone:  Awaiting Review
Component:  Permalinks      |    Version:  3.9.1
 Severity:  normal          |   Keywords:
  Focuses:  administration  |
----------------------------+-----------------------------
 Note: My installation on my dev machine is at c:\www\krystal\wordpress (as
 a subdirectory).

 Upon visiting the permalink settings page (), an error is visible at the
 top of the page:

 {{{
 Warning: DOMDocument::load(): I/O warning : failed to load external entity
 "c://www//krystal/web.config" in C:\www\krystal\wordpress\wp-
 admin\includes\misc.php on line 517
 }}}

 Saving the settings fails with the same error, and does not actually
 update the web.config as expected.

 I chased this bug all the way to the `wp-
 admin/includes/file.php:get_home_path` function which seems to assume that
 magic quotes have not been applied to `$_SERVER` variables. See #18322 for
 more details on this issue.

 Anyway, the fix is pretty simple. There are two references to
 `$_SERVER['SCRIPT_FILENAME']`. These should be wrapped in `stripslashes`.

 With the fix in place, the permalink options page functions correctly (no
 errors, and web.config is updated as expected).

 I suspect this might fix other places that call win_is_writable as well,
 but I haven't noticed anything else.

 BEFORE:

 {{{
 $pos = strripos( str_replace( '\\', '/', $_SERVER['SCRIPT_FILENAME'] ),
 trailingslashit( $wp_path_rel_to_home ) );
 $home_path = substr( $_SERVER['SCRIPT_FILENAME'], 0, $pos );
 }}}

 AFTER:

 {{{
 $pos = strripos( str_replace( '\\', '/', stripslashes(
 $_SERVER['SCRIPT_FILENAME'] ) ), trailingslashit( $wp_path_rel_to_home )
 );
 $home_path = substr( stripslashes( $_SERVER['SCRIPT_FILENAME'] ), 0, $pos
 );
 }}}

--
Ticket URL: <https://core.trac.wordpress.org/ticket/28246>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform