Validate URL in Locate Template

WordPress · May 4, 2024 · fa524a7 · fa524a7
1 parent a412372
commit fa524a7
Showing 1 changed file with 10 additions and 6 deletions.
diff --git a/src/wp-includes/template.php b/src/wp-includes/template.php
@@ -729,15 +729,19 @@ function locate_template( $template_names, $load = false, $load_once = true, $ar
  if ( ! $template_name ) {
  continue;
  }
- if ( file_exists( $wp_stylesheet_path . '/' . $template_name ) ) {
- $located = $wp_stylesheet_path . '/' . $template_name;
+
+ $stylesheet = $wp_stylesheet_path . '/' . $template_name;
+ $template = $wp_template_path . '/' . $template_name;
+ $template_compat = ABSPATH . WPINC . '/theme-compat/' . $template_name;
+
+ if ( file_exists( $stylesheet ) && 0 === validate_file( $stylesheet ) ) {
+ $located = $stylesheet;
  break;
- } elseif ( $is_child_theme && file_exists( $wp_template_path . '/' . $template_name ) ) {
+ } elseif ( is_child_theme() && file_exists( $template ) && 0 === validate_file( $template ) ) {
  $located = $wp_template_path . '/' . $template_name;
  break;
- } elseif ( file_exists( ABSPATH . WPINC . '/theme-compat/' . $template_name ) ) {
- $located = ABSPATH . WPINC . '/theme-compat/' . $template_name;
- break;
+ } elseif ( file_exists( $template_compat ) && 0 === validate_file( $template_compat ) ) {
+ $located = $template_compat;
  }
  }