[wp-trac] [WordPress Trac] #46982: Avoid loading dot files in the mu-plugins directory.

[WordPress Trac]

#46982: Avoid loading dot files in the mu-plugins directory.
-------------------------------------+------------------------------
 Reporter:  dcavins                  |       Owner:  (none)
     Type:  defect (bug)             |      Status:  new
 Priority:  normal                   |   Milestone:  Awaiting Review
Component:  Plugins                  |     Version:  2.8
 Severity:  normal                   |  Resolution:
 Keywords:  has-patch has-test-info  |     Focuses:
-------------------------------------+------------------------------
Changes (by huzaifaalmesbah):

 * keywords:  has-patch => has-patch has-test-info


Comment:

 === Patch Testing Report

 Patch Tested: [attachment:"46982.2.diff"]

 === Environment
 - WordPress: 7.0-alpha-61215-src (trunk)
 - PHP: 8.2.30
 - Server: nginx/1.29.4
 - Database: mysqli (Server: 9.5.0 / Client: mysqlnd 8.2.30)
 - Browser: Chrome 144
 - OS: macOS
 - Theme: Twenty Nineteen 3.2
 - MU Plugins:
   * ._dotfile-test.php (test file)
 - Plugins:
   * Classic Editor 1.6.7
   * Test Reports 1.2.1

 === Steps taken
 1. Created /wp-content/mu-plugins/ directory.
 2. Added a dotfile plugin named ._dotfile-test.php with an admin notice
 (see snippet below).
 3. Loaded wp-admin without the patch.
 4. Observed the dotfile plugin was executed and displayed an error notice.
 5. Applied 46982.2.diff.
 6. Reloaded wp-admin.
 7. Confirmed the dotfile plugin is no longer loaded or executed.
 8. ✅ Patch is solving the problem

 === Expected result
 - Files beginning with "._" should NOT be detected or loaded as MU
 plugins.
 - Dotfiles must be ignored by wp_get_mu_plugins().
 - No PHP execution or output from metadata/system files.


 === Screenshots/Screencast with results
 || Before Apply Patch || After Apply Patch ✅ ||
 || [[Image(https://i.ibb.co/5W1qNc1n/Huzaifa-20260202211826.png)]] ||
 [[Image(https://i.ibb.co/N6V0q0Mt/Huzaifa-20260202211929.png)]] ||

 === Support Content

 Test MU plugin used:


 {{{
 <?php
 /**
  * This file SHOULD NEVER LOAD.
  * If you see this notice, WordPress is loading dotfiles (bug).
  */
 add_action('admin_notices', function () {
     echo '<div class="notice notice-error"><p><strong>BUG:</strong>
 Dotfile MU plugin was loaded.</p></div>';
 });
 }}}

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/46982#comment:8>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform