global $wp_file_descriptions, $allowed_files;

$dirname = pathinfo( $file, PATHINFO_DIRNAME );

$file_path = $allowed_files[ $file ];

if ( isset( $wp_file_descriptions[ basename( $file ) ] ) && '.' === $dirname ) {

return $wp_file_descriptions[ basename( $file ) ];

} elseif ( file_exists( $file_path ) && is_file( $file_path ) ) {

$template_data = implode( '', file( $file_path ) );

if ( preg_match( '|Template Name:(.*)$|mi', $template_data, $name ) ) {

/* translators: %s: Template name. */

return sprintf( __( '%s Page Template' ), _cleanup_header_comment( $name[1] ) );

}

}

return trim( basename( $file ) );

$home = set_url_scheme( get_option( 'home' ), 'http' );

$siteurl = set_url_scheme( get_option( 'siteurl' ), 'http' );

if ( ! empty( $home ) && 0 !== strcasecmp( $home, $siteurl ) ) {

$wp_path_rel_to_home = str_ireplace( $home, '', $siteurl ); /* $siteurl - $home */

$pos = strripos( str_replace( '\\', '/', $_SERVER['SCRIPT_FILENAME'] ), trailingslashit( $wp_path_rel_to_home ) );

$home_path = substr( $_SERVER['SCRIPT_FILENAME'], 0, $pos );

$home_path = trailingslashit( $home_path );

} else {

$home_path = ABSPATH;

}

return str_replace( '\\', '/', $home_path );

if ( empty( $folder ) ) {

return false;

}

$folder = trailingslashit( $folder );

if ( ! $levels ) {

return false;

}

$files = array();

$dir = @opendir( $folder );

if ( $dir ) {

while ( ( $file = readdir( $dir ) ) !== false ) {

// Skip current and parent folder links.

if ( in_array( $file, array( '.', '..' ), true ) ) {

continue;

}

// Skip hidden and excluded files.

if ( '.' === $file[0] || in_array( $file, $exclusions, true ) ) {

continue;

}

if ( is_dir( $folder . $file ) ) {

$files2 = list_files( $folder . $file, $levels - 1 );

if ( $files2 ) {

$files = array_merge( $files, $files2 );

} else {

$files[] = $folder . $file . '/';

}

} else {

$files[] = $folder . $file;

}

}

closedir( $dir );

}

return $files;

$default_types = array(

'bash',

'conf',

'css',

'diff',

'htm',

'html',

'http',

'inc',

'include',

'js',

'json',

'jsx',

'less',

'md',

'patch',

'php',

'php3',

'php4',

'php5',

'php7',

'phps',

'phtml',

'sass',

'scss',

'sh',

'sql',

'svg',

'text',

'txt',

'xml',

'yaml',

'yml',

);

/**

$file_types = (array) apply_filters( 'editable_extensions', $default_types, $plugin );

return $file_types;

$default_types = array(

'bash',

'conf',

'css',

'diff',

'htm',

'html',

'http',

'inc',

'include',

'js',

'json',

'jsx',

'less',

'md',

'patch',

'php',

'php3',

'php4',

'php5',

'php7',

'phps',

'phtml',

'sass',

'scss',

'sh',

'sql',

'svg',

'text',

'txt',

'xml',

'yaml',

'yml',

);

/**

$file_types = apply_filters( 'wp_theme_editor_filetypes', $default_types, $theme );

// Ensure that default types are still there.

return array_unique( array_merge( $file_types, $default_types ) );

?>

<script type="text/html" id="tmpl-wp-file-editor-notice">

<div class="notice inline notice-{{ data.type || 'info' }} {{ data.alt ? 'notice-alt' : '' }} {{ data.dismissible ? 'is-dismissible' : '' }} {{ data.classes || '' }}">

<# if ( 'php_error' === data.code ) { #>

<p>

<?php

printf(

/* translators: 1: Line number, 2: File path. */

__( 'Your PHP code changes were rolled back due to an error on line %1$s of file %2$s. Please fix and try saving again.' ),

'{{ data.line }}',

'{{ data.file }}'

);

?>

</p>

<pre>{{ data.message }}</pre>

<# } else if ( 'file_not_writable' === data.code ) { #>

<p>

<?php

printf(

/* translators: %s: Documentation URL. */

__( 'You need to make this file writable before you can save your changes. See <a href="%s">Changing File Permissions</a> for more information.' ),

__( 'https://wordpress.org/support/article/changing-file-permissions/' )

);

?>

</p>

<# } else { #>

<p>{{ data.message || data.code }}</p>

<# if ( 'lint_errors' === data.code ) { #>

<p>

<# var elementId = 'el-' + String( Math.random() ); #>

<input id="{{ elementId }}" type="checkbox">

<label for="{{ elementId }}"><?php _e( 'Update anyway, even though it might break your site?' ); ?></label>

</p>

<# } #>

<# } #>

<# if ( data.dismissible ) { #>

<button type="button" class="notice-dismiss"><span class="screen-reader-text"><?php _e( 'Dismiss' ); ?></span></button>

<# } #>

</div>

</script>

<?php

if ( empty( $args['file'] ) ) {

return new WP_Error( 'missing_file' );

}

if ( 0 !== validate_file( $args['file'] ) ) {

return new WP_Error( 'bad_file' );

}

if ( ! isset( $args['newcontent'] ) ) {

return new WP_Error( 'missing_content' );

}

if ( ! isset( $args['nonce'] ) ) {

return new WP_Error( 'missing_nonce' );

}

$file = $args['file'];

$content = $args['newcontent'];

$plugin = null;

$theme = null;

$real_file = null;

if ( ! empty( $args['plugin'] ) ) {

$plugin = $args['plugin'];

if ( ! current_user_can( 'edit_plugins' ) ) {

return new WP_Error( 'unauthorized', __( 'Sorry, you are not allowed to edit plugins for this site.' ) );

}

if ( ! wp_verify_nonce( $args['nonce'], 'edit-plugin_' . $file ) ) {

return new WP_Error( 'nonce_failure' );

}

if ( ! array_key_exists( $plugin, get_plugins() ) ) {

return new WP_Error( 'invalid_plugin' );

}

if ( 0 !== validate_file( $file, get_plugin_files( $plugin ) ) ) {

return new WP_Error( 'bad_plugin_file_path', __( 'Sorry, that file cannot be edited.' ) );

}

$editable_extensions = wp_get_plugin_file_editable_extensions( $plugin );

$real_file = WP_PLUGIN_DIR . '/' . $file;

$is_active = in_array(

$plugin,

(array) get_option( 'active_plugins', array() ),

true

);

} elseif ( ! empty( $args['theme'] ) ) {

$stylesheet = $args['theme'];

if ( 0 !== validate_file( $stylesheet ) ) {

return new WP_Error( 'bad_theme_path' );

}

if ( ! current_user_can( 'edit_themes' ) ) {

return new WP_Error( 'unauthorized', __( 'Sorry, you are not allowed to edit templates for this site.' ) );

}

$theme = wp_get_theme( $stylesheet );

if ( ! $theme->exists() ) {

return new WP_Error( 'non_existent_theme', __( 'The requested theme does not exist.' ) );

}

if ( ! wp_verify_nonce( $args['nonce'], 'edit-theme_' . $stylesheet . '_' . $file ) ) {

return new WP_Error( 'nonce_failure' );

}

if ( $theme->errors() && 'theme_no_stylesheet' === $theme->errors()->get_error_code() ) {

return new WP_Error(

'theme_no_stylesheet',

__( 'The requested theme does not exist.' ) . ' ' . $theme->errors()->get_error_message()

);

}

$editable_extensions = wp_get_theme_file_editable_extensions( $theme );

$allowed_files = array();

foreach ( $editable_extensions as $type ) {

switch ( $type ) {

case 'php':

$allowed_files = array_merge( $allowed_files, $theme->get_files( 'php', -1 ) );

break;

case 'css':

$style_files = $theme->get_files( 'css', -1 );

$allowed_files['style.css'] = $style_files['style.css'];

$allowed_files = array_merge( $allowed_files, $style_files );

break;

default:

$allowed_files = array_merge( $allowed_files, $theme->get_files( $type, -1 ) );

break;

}

}

// Compare based on relative paths.

if ( 0 !== validate_file( $file, array_keys( $allowed_files ) ) ) {

return new WP_Error( 'disallowed_theme_file', __( 'Sorry, that file cannot be edited.' ) );

}

$real_file = $theme->get_stylesheet_directory() . '/' . $file;

$is_active = ( get_stylesheet() === $stylesheet || get_template() === $stylesheet );

} else {

return new WP_Error( 'missing_theme_or_plugin' );

}

// Ensure file is real.

if ( ! is_file( $real_file ) ) {

return new WP_Error( 'file_does_not_exist', __( 'File does not exist! Please double check the name and try again.' ) );

}

// Ensure file extension is allowed.

$extension = null;

if ( preg_match( '/\.([^.]+)$/', $real_file, $matches ) ) {

$extension = strtolower( $matches[1] );

if ( ! in_array( $extension, $editable_extensions, true ) ) {

return new WP_Error( 'illegal_file_type', __( 'Files of this type are not editable.' ) );

}

}

$previous_content = file_get_contents( $real_file );

if ( ! is_writable( $real_file ) ) {

return new WP_Error( 'file_not_writable' );

}

$f = fopen( $real_file, 'w+' );

if ( false === $f ) {

return new WP_Error( 'file_not_writable' );

}

$written = fwrite( $f, $content );

fclose( $f );

if ( false === $written ) {

return new WP_Error( 'unable_to_write', __( 'Unable to write to file.' ) );

}

wp_opcache_invalidate( $real_file, true );

if ( $is_active && 'php' === $extension ) {

$scrape_key = md5( rand() );

$transient = 'scrape_key_' . $scrape_key;

$scrape_nonce = (string) rand();

// It shouldn't take more than 60 seconds to make the two loopback requests.

set_transient( $transient, $scrape_nonce, 60 );

$cookies = wp_unslash( $_COOKIE );

$scrape_params = array(

'wp_scrape_key' => $scrape_key,

'wp_scrape_nonce' => $scrape_nonce,

);

$headers = array(

'Cache-Control' => 'no-cache',

);

/** This filter is documented in wp-includes/class-wp-http-streams.php */

$sslverify = apply_filters( 'https_local_ssl_verify', false );

// Include Basic auth in loopback requests.

if ( isset( $_SERVER['PHP_AUTH_USER'] ) && isset( $_SERVER['PHP_AUTH_PW'] ) ) {

$headers['Authorization'] = 'Basic ' . base64_encode( wp_unslash( $_SERVER['PHP_AUTH_USER'] ) . ':' . wp_unslash( $_SERVER['PHP_AUTH_PW'] ) );

}

// Make sure PHP process doesn't die before loopback requests complete.

set_time_limit( 300 );

// Time to wait for loopback requests to finish.

$timeout = 100;

$needle_start = "###### wp_scraping_result_start:$scrape_key ######";

$needle_end = "###### wp_scraping_result_end:$scrape_key ######";

// Attempt loopback request to editor to see if user just whitescreened themselves.

if ( $plugin ) {

$url = add_query_arg( compact( 'plugin', 'file' ), admin_url( 'plugin-editor.php' ) );

} elseif ( isset( $stylesheet ) ) {

$url = add_query_arg(

array(

'theme' => $stylesheet,

'file' => $file,

),

admin_url( 'theme-editor.php' )

);

} else {

$url = admin_url();

}

if ( function_exists( 'session_status' ) && PHP_SESSION_ACTIVE === session_status() ) {

// Close any active session to prevent HTTP requests from timing out

// when attempting to connect back to the site.

session_write_close();

}

$url = add_query_arg( $scrape_params, $url );

$r = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );

$body = wp_remote_retrieve_body( $r );

$scrape_result_position = strpos( $body, $needle_start );

$loopback_request_failure = array(

'code' => 'loopback_request_failed',

'message' => __( 'Unable to communicate back with site to check for fatal errors, so the PHP change was reverted. You will need to upload your PHP file change by some other means, such as by using SFTP.' ),

);

$json_parse_failure = array(

'code' => 'json_parse_error',

);

$result = null;

if ( false === $scrape_result_position ) {

$result = $loopback_request_failure;

} else {

$error_output = substr( $body, $scrape_result_position + strlen( $needle_start ) );

$error_output = substr( $error_output, 0, strpos( $error_output, $needle_end ) );

$result = json_decode( trim( $error_output ), true );

if ( empty( $result ) ) {

$result = $json_parse_failure;

}

}

// Try making request to homepage as well to see if visitors have been whitescreened.

if ( true === $result ) {

$url = home_url( '/' );

$url = add_query_arg( $scrape_params, $url );

$r = wp_remote_get( $url, compact( 'cookies', 'headers', 'timeout', 'sslverify' ) );

$body = wp_remote_retrieve_body( $r );

$scrape_result_position = strpos( $body, $needle_start );

if ( false === $scrape_result_position ) {

$result = $loopback_request_failure;

} else {

$error_output = substr( $body, $scrape_result_position + strlen( $needle_start ) );

$error_output = substr( $error_output, 0, strpos( $error_output, $needle_end ) );

$result = json_decode( trim( $error_output ), true );

if ( empty( $result ) ) {

$result = $json_parse_failure;

}

}

}

delete_transient( $transient );

if ( true !== $result ) {

// Roll-back file change.

file_put_contents( $real_file, $previous_content );

wp_opcache_invalidate( $real_file, true );

if ( ! isset( $result['message'] ) ) {

$message = __( 'Something went wrong.' );

} else {

$message = $result['message'];

unset( $result['message'] );

}

return new WP_Error( 'php_error', $message, $result );

}

}

if ( $theme instanceof WP_Theme ) {

$theme->cache_delete();

}

return true;

if ( empty( $dir ) ) {

$dir = get_temp_dir();

}

if ( empty( $filename ) || in_array( $filename, array( '.', '/', '\\' ), true ) ) {

$filename = uniqid();

}

// Use the basename of the given file without the extension as the name for the temporary directory.

$temp_filename = basename( $filename );

$temp_filename = preg_replace( '|\.[^.]*$|', '', $temp_filename );

// If the folder is falsey, use its parent directory name instead.

if ( ! $temp_filename ) {

return wp_tempnam( dirname( $filename ), $dir );

}

// Suffix some random data to avoid filename conflicts.

$temp_filename .= '-' . wp_generate_password( 6, false );

$temp_filename .= '.tmp';

$temp_filename = $dir . wp_unique_filename( $dir, $temp_filename );

$fp = @fopen( $temp_filename, 'x' );

if ( ! $fp && is_writable( $dir ) && file_exists( $temp_filename ) ) {

return wp_tempnam( $filename, $dir );

}

if ( $fp ) {

fclose( $fp );

}

return $temp_filename;

$code = validate_file( $file, $allowed_files );

if ( ! $code ) {

return $file;

}

switch ( $code ) {

case 1:

wp_die( __( 'Sorry, that file cannot be edited.' ) );

// case 2 :

// wp_die( __('Sorry, can&#8217;t call files with their real path.' ));

case 3:

wp_die( __( 'Sorry, that file cannot be edited.' ) );

}

// The default error handler.

if ( ! function_exists( 'wp_handle_upload_error' ) ) {

function wp_handle_upload_error( &$file, $message ) {

return array( 'error' => $message );

}

}

/**

$file = apply_filters( "{$action}_prefilter", $file );

/**

$overrides = apply_filters( "{$action}_overrides", $overrides, $file );

// You may define your own function and pass the name in $overrides['upload_error_handler'].

$upload_error_handler = 'wp_handle_upload_error';

if ( isset( $overrides['upload_error_handler'] ) ) {

$upload_error_handler = $overrides['upload_error_handler'];

}

// You may have had one or more 'wp_handle_upload_prefilter' functions error out the file. Handle that gracefully.

if ( isset( $file['error'] ) && ! is_numeric( $file['error'] ) && $file['error'] ) {

return call_user_func_array( $upload_error_handler, array( &$file, $file['error'] ) );

}

// Install user overrides. Did we mention that this voids your warranty?

// You may define your own function and pass the name in $overrides['unique_filename_callback'].

$unique_filename_callback = null;

if ( isset( $overrides['unique_filename_callback'] ) ) {

$unique_filename_callback = $overrides['unique_filename_callback'];

}

/*

if ( isset( $overrides['upload_error_strings'] ) ) {

$upload_error_strings = $overrides['upload_error_strings'];

} else {

// Courtesy of php.net, the strings that describe the error indicated in $_FILES[{form field}]['error'].

$upload_error_strings = array(

false,

sprintf(

/* translators: 1: upload_max_filesize, 2: php.ini */

__( 'The uploaded file exceeds the %1$s directive in %2$s.' ),

'upload_max_filesize',

'php.ini'

),

sprintf(

/* translators: %s: MAX_FILE_SIZE */

__( 'The uploaded file exceeds the %s directive that was specified in the HTML form.' ),

'MAX_FILE_SIZE'

),

__( 'The uploaded file was only partially uploaded.' ),

__( 'No file was uploaded.' ),

'',

__( 'Missing a temporary folder.' ),

__( 'Failed to write file to disk.' ),

__( 'File upload stopped by extension.' ),

);

}

// All tests are on by default. Most can be turned off by $overrides[{test_name}] = false;

$test_form = isset( $overrides['test_form'] ) ? $overrides['test_form'] : true;

$test_size = isset( $overrides['test_size'] ) ? $overrides['test_size'] : true;

// If you override this, you must provide $ext and $type!!

$test_type = isset( $overrides['test_type'] ) ? $overrides['test_type'] : true;

$mimes = isset( $overrides['mimes'] ) ? $overrides['mimes'] : false;

// A correct form post will pass this test.

if ( $test_form && ( ! isset( $_POST['action'] ) || $_POST['action'] !== $action ) ) {

return call_user_func_array( $upload_error_handler, array( &$file, __( 'Invalid form submission.' ) ) );

}

// A successful upload will pass this test. It makes no sense to override this one.

if ( isset( $file['error'] ) && $file['error'] > 0 ) {

return call_user_func_array( $upload_error_handler, array( &$file, $upload_error_strings[ $file['error'] ] ) );

}

// A properly uploaded file will pass this test. There should be no reason to override this one.

$test_uploaded_file = 'wp_handle_upload' === $action ? is_uploaded_file( $file['tmp_name'] ) : @is_readable( $file['tmp_name'] );

if ( ! $test_uploaded_file ) {

return call_user_func_array( $upload_error_handler, array( &$file, __( 'Specified file failed upload test.' ) ) );

}

$test_file_size = 'wp_handle_upload' === $action ? $file['size'] : filesize( $file['tmp_name'] );

// A non-empty file will pass this test.

if ( $test_size && ! ( $test_file_size > 0 ) ) {

if ( is_multisite() ) {

$error_msg = __( 'File is empty. Please upload something more substantial.' );

} else {

$error_msg = sprintf(

/* translators: 1: php.ini, 2: post_max_size, 3: upload_max_filesize */

__( 'File is empty. Please upload something more substantial. This error could also be caused by uploads being disabled in your %1$s file or by %2$s being defined as smaller than %3$s in %1$s.' ),

'php.ini',

'post_max_size',

'upload_max_filesize'

);

}

return call_user_func_array( $upload_error_handler, array( &$file, $error_msg ) );

}

// A correct MIME type will pass this test. Override $mimes or use the upload_mimes filter.

if ( $test_type ) {

$wp_filetype = wp_check_filetype_and_ext( $file['tmp_name'], $file['name'], $mimes );

$ext = empty( $wp_filetype['ext'] ) ? '' : $wp_filetype['ext'];

$type = empty( $wp_filetype['type'] ) ? '' : $wp_filetype['type'];

$proper_filename = empty( $wp_filetype['proper_filename'] ) ? '' : $wp_filetype['proper_filename'];

// Check to see if wp_check_filetype_and_ext() determined the filename was incorrect.

if ( $proper_filename ) {

$file['name'] = $proper_filename;

}

if ( ( ! $type || ! $ext ) && ! current_user_can( 'unfiltered_upload' ) ) {

return call_user_func_array( $upload_error_handler, array( &$file, __( 'Sorry, this file type is not permitted for security reasons.' ) ) );

}

if ( ! $type ) {

$type = $file['type'];

}

} else {

$type = '';

}

/*

$uploads = wp_upload_dir( $time );

if ( ! ( $uploads && false === $uploads['error'] ) ) {

return call_user_func_array( $upload_error_handler, array( &$file, $uploads['error'] ) );

}

$filename = wp_unique_filename( $uploads['path'], $file['name'], $unique_filename_callback );

// Move the file to the uploads dir.

$new_file = $uploads['path'] . "/$filename";

/**

$move_new_file = apply_filters( 'pre_move_uploaded_file', null, $file, $new_file, $type );

if ( null === $move_new_file ) {

if ( 'wp_handle_upload' === $action ) {

$move_new_file = @move_uploaded_file( $file['tmp_name'], $new_file );

} else {

// Use copy and unlink because rename breaks streams.

// phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged

$move_new_file = @copy( $file['tmp_name'], $new_file );

unlink( $file['tmp_name'] );

}

if ( false === $move_new_file ) {

if ( 0 === strpos( $uploads['basedir'], ABSPATH ) ) {

$error_path = str_replace( ABSPATH, '', $uploads['basedir'] ) . $uploads['subdir'];

} else {

$error_path = basename( $uploads['basedir'] ) . $uploads['subdir'];

}

return $upload_error_handler(

$file,

sprintf(

/* translators: %s: Destination file path. */

__( 'The uploaded file could not be moved to %s.' ),

$error_path

)

);

}

}

// Set correct file permissions.

$stat = stat( dirname( $new_file ) );

$perms = $stat['mode'] & 0000666;

chmod( $new_file, $perms );

// Compute the URL.

$url = $uploads['url'] . "/$filename";

if ( is_multisite() ) {

clean_dirsize_cache( $new_file );

}

/**

return apply_filters(

'wp_handle_upload',

array(