From 5f14fc0a166c186869912e94403d34fdcd866dcb Mon Sep 17 00:00:00 2001 From: johnjamesjacoby Date: Fri, 17 Oct 2025 17:14:32 +0000 Subject: [PATCH] Networks and Sites: check if the `BLOGUPLOADDIR` constant is defined before using it. This change prevents a fatal PHP error from occurring when `ms-files.php` is accessed without legacy multisite file-handling support being configured. Instead of the fatal error, these same requests will new return a header status `500` along with a `die()` message "500 - Directory not configured." This differs from the existing `404` statuses to help indicate to site owners this fallback is not working as intended. Props danielpw, dd32, jakeparis, johnjamesjacoby, spacedmonkey, saurabh.dhariwal, sukhendu2002, realloc. Fixes #63104. Built from https://develop.svn.wordpress.org/trunk@60956 git-svn-id: http://core.svn.wordpress.org/trunk@60292 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/ms-files.php | 5 +++++ wp-includes/version.php | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/wp-includes/ms-files.php b/wp-includes/ms-files.php index 42826ede61..d17d9f95f7 100644 --- a/wp-includes/ms-files.php +++ b/wp-includes/ms-files.php @@ -25,6 +25,11 @@ if ( '1' === $current_blog->archived || '1' === $current_blog->spam || '1' === $ die( '404 — File not found.' ); } +if ( ! defined( 'BLOGUPLOADDIR' ) ) { + status_header( 500 ); + die( '500 — Directory not configured.' ); +} + $file = rtrim( BLOGUPLOADDIR, '/' ) . '/' . str_replace( '..', '', $_GET['file'] ); if ( ! is_file( $file ) ) { status_header( 404 ); diff --git a/wp-includes/version.php b/wp-includes/version.php index c09ffb73b0..407253d531 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -16,7 +16,7 @@ * * @global string $wp_version */ -$wp_version = '6.9-alpha-60955'; +$wp_version = '6.9-alpha-60956'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.