From b73bbd8139d3e3ee1ad91328b2502e3582e37010 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov.ru@gmail.com>
Date: Mon, 18 May 2020 12:32:10 +0000
Subject: [PATCH] Themes: Prevent activation and live preview of themes that
 require a higher version of PHP or WordPress.

Props afragen, jorbin, TimothyBlynJacobs, SergeyBiryukov.
See #48491.
Built from https://develop.svn.wordpress.org/trunk@47816


git-svn-id: http://core.svn.wordpress.org/trunk@47592 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/customize.php                        | 21 +++++--
 wp-admin/includes/ajax-actions.php            |  6 +-
 wp-admin/includes/theme.php                   | 37 +++++++-----
 wp-admin/theme-install.php                    | 36 ++++++++----
 wp-admin/themes.php                           | 57 ++++++++++++++-----
 .../class-wp-customize-theme-control.php      |  6 +-
 wp-includes/version.php                       |  2 +-
 7 files changed, 117 insertions(+), 48 deletions(-)

diff --git a/wp-admin/customize.php b/wp-admin/customize.php
index a8b62f4195..375804d568 100644
--- a/wp-admin/customize.php
+++ b/wp-admin/customize.php
@@ -177,11 +177,22 @@ do_action( 'customize_controls_print_scripts' );
 <div class="wp-full-overlay expanded">
 	<form id="customize-controls" class="wrap wp-full-overlay-sidebar">
 		<div id="customize-header-actions" class="wp-full-overlay-header">
-			<?php $save_text = $wp_customize->is_theme_active() ? __( 'Publish' ) : __( 'Activate &amp; Publish' ); ?>
-			<div id="customize-save-button-wrapper" class="customize-save-button-wrapper" >
-				<?php submit_button( $save_text, 'primary save', 'save', false ); ?>
-				<button id="publish-settings" class="publish-settings button-primary button dashicons dashicons-admin-generic" aria-label="<?php esc_attr_e( 'Publish Settings' ); ?>" aria-expanded="false" disabled></button>
-			</div>
+			<?php
+			$compatible_wp  = is_wp_version_compatible( $wp_customize->theme()->get( 'RequiresWP' ) );
+			$compatible_php = is_php_version_compatible( $wp_customize->theme()->get( 'RequiresPHP' ) );
+			?>
+			<?php if ( $compatible_wp && $compatible_php ) : ?>
+				<?php $save_text = $wp_customize->is_theme_active() ? __( 'Publish' ) : __( 'Activate &amp; Publish' ); ?>
+				<div id="customize-save-button-wrapper" class="customize-save-button-wrapper" >
+					<?php submit_button( $save_text, 'primary save', 'save', false ); ?>
+					<button id="publish-settings" class="publish-settings button-primary button dashicons dashicons-admin-generic" aria-label="<?php esc_attr_e( 'Publish Settings' ); ?>" aria-expanded="false" disabled></button>
+				</div>
+			<?php else : ?>
+				<?php $save_text = _x( 'Cannot Activate', 'theme' ); ?>
+				<div id="customize-save-button-wrapper" class="customize-save-button-wrapper disabled" >
+					<button class="button button-primary disabled" aria-label="<?php esc_attr_e( 'Publish Settings' ); ?>" aria-expanded="false" disabled><?php echo $save_text; ?></button>
+				</div>
+			<?php endif; ?>
 			<span class="spinner"></span>
 			<button type="button" class="customize-controls-preview-toggle">
 				<span class="controls"><?php _e( 'Customize' ); ?></span>
diff --git a/wp-admin/includes/ajax-actions.php b/wp-admin/includes/ajax-actions.php
index 8f0d1f8822..f7e03b191e 100644
--- a/wp-admin/includes/ajax-actions.php
+++ b/wp-admin/includes/ajax-actions.php
@@ -3571,8 +3571,10 @@ function wp_ajax_query_themes() {
 			)
 		);
 
-		$theme->num_ratings = number_format_i18n( $theme->num_ratings );
-		$theme->preview_url = set_url_scheme( $theme->preview_url );
+		$theme->num_ratings    = number_format_i18n( $theme->num_ratings );
+		$theme->preview_url    = set_url_scheme( $theme->preview_url );
+ 		$theme->compatible_wp  = is_wp_version_compatible( $theme->requires );
+ 		$theme->compatible_php = is_php_version_compatible( $theme->requires_php );
 	}
 
 	wp_send_json_success( $api );
diff --git a/wp-admin/includes/theme.php b/wp-admin/includes/theme.php
index c622be3dfd..efdb4fa53a 100644
--- a/wp-admin/includes/theme.php
+++ b/wp-admin/includes/theme.php
@@ -684,20 +684,22 @@ function wp_prepare_themes_for_js( $themes = null ) {
 		}
 
 		$prepared_themes[ $slug ] = array(
-			'id'           => $slug,
-			'name'         => $theme->display( 'Name' ),
-			'screenshot'   => array( $theme->get_screenshot() ), // @todo Multiple screenshots.
-			'description'  => $theme->display( 'Description' ),
-			'author'       => $theme->display( 'Author', false, true ),
-			'authorAndUri' => $theme->display( 'Author' ),
-			'version'      => $theme->display( 'Version' ),
-			'tags'         => $theme->display( 'Tags' ),
-			'parent'       => $parent,
-			'active'       => $slug === $current_theme,
-			'hasUpdate'    => isset( $updates[ $slug ] ),
-			'hasPackage'   => isset( $updates[ $slug ] ) && ! empty( $updates[ $slug ]['package'] ),
-			'update'       => get_theme_update_available( $theme ),
-			'actions'      => array(
+			'id'            => $slug,
+			'name'          => $theme->display( 'Name' ),
+			'screenshot'    => array( $theme->get_screenshot() ), // @todo Multiple screenshots.
+			'description'   => $theme->display( 'Description' ),
+			'author'        => $theme->display( 'Author', false, true ),
+			'authorAndUri'  => $theme->display( 'Author' ),
+			'tags'          => $theme->display( 'Tags' ),
+			'version'       => $theme->get( 'Version' ),
+ 			'compatibleWP'  => is_wp_version_compatible( $theme->get( 'RequiresWP' ) ),
+ 			'compatiblePHP' => is_php_version_compatible( $theme->get( 'RequiresPHP' ) ),
+			'parent'        => $parent,
+			'active'        => $slug === $current_theme,
+			'hasUpdate'     => isset( $updates[ $slug ] ),
+			'hasPackage'    => isset( $updates[ $slug ] ) && ! empty( $updates[ $slug ]['package'] ),
+			'update'        => get_theme_update_available( $theme ),
+			'actions'       => array(
 				'activate'  => current_user_can( 'switch_themes' ) ? wp_nonce_url( admin_url( 'themes.php?action=activate&amp;stylesheet=' . $encoded_slug ), 'switch-theme_' . $slug ) : null,
 				'customize' => $customize_action,
 				'delete'    => current_user_can( 'delete_themes' ) ? wp_nonce_url( admin_url( 'themes.php?action=delete&amp;stylesheet=' . $encoded_slug ), 'delete-theme_' . $slug ) : null,
@@ -818,7 +820,12 @@ function customize_themes_print_templates() {
 							<a href="{{{ data.actions['delete'] }}}" data-slug="{{ data.id }}" class="button button-secondary delete-theme"><?php _e( 'Delete' ); ?></a>
 						<# } #>
 					<?php } ?>
-					<button type="button" class="button button-primary preview-theme" data-slug="{{ data.id }}"><?php _e( 'Live Preview' ); ?></button>
+
+					<# if ( data.compatibleWP && data.compatiblePHP ) { #>
+						<button type="button" class="button button-primary preview-theme" data-slug="{{ data.id }}"><?php _e( 'Live Preview' ); ?></button>
+					<# } else { #>
+						<button class="button button-primary disabled"><?php _e( 'Live Preview' ); ?></button>
+					<# } #>
 				<# } else { #>
 					<button type="button" class="button theme-install" data-slug="{{ data.id }}"><?php _e( 'Install' ); ?></button>
 					<button type="button" class="button button-primary theme-install preview" data-slug="{{ data.id }}"><?php _e( 'Install &amp; Preview' ); ?></button>
diff --git a/wp-admin/theme-install.php b/wp-admin/theme-install.php
index 2519ed01ae..6d8ea54542 100644
--- a/wp-admin/theme-install.php
+++ b/wp-admin/theme-install.php
@@ -282,18 +282,34 @@ if ( $tab ) {
 		<h3 class="theme-name">{{ data.name }}</h3>
 
 		<div class="theme-actions">
+			<# console.log( data ); #>
 			<# if ( data.installed ) { #>
-				<?php
-				/* translators: %s: Theme name. */
-				$aria_label = sprintf( _x( 'Activate %s', 'theme' ), '{{ data.name }}' );
-				?>
-				<# if ( data.activate_url ) { #>
-					<a class="button button-primary activate" href="{{ data.activate_url }}" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _e( 'Activate' ); ?></a>
-				<# } #>
-				<# if ( data.customize_url ) { #>
-					<a class="button load-customize" href="{{ data.customize_url }}"><?php _e( 'Live Preview' ); ?></a>
+				<# if ( data.compatible_wp && data.compatible_php ) { #>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( _x( 'Activate %s', 'theme' ), '{{ data.name }}' );
+					?>
+					<# if ( data.activate_url ) { #>
+						<a class="button button-primary activate" href="{{ data.activate_url }}" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _e( 'Activate' ); ?></a>
+					<# } #>
+					<# if ( data.customize_url ) { #>
+						<a class="button load-customize" href="{{ data.customize_url }}"><?php _e( 'Live Preview' ); ?></a>
+					<# } else { #>
+						<button class="button preview install-theme-preview"><?php _e( 'Preview' ); ?></button>
+					<# } #>
 				<# } else { #>
-					<button class="button preview install-theme-preview"><?php _e( 'Preview' ); ?></button>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( _x( 'Cannot Activate %s', 'theme' ), '{{ data.name }}' );
+					?>
+					<# if ( data.activate_url ) { #>
+						<a class="button button-primary disabled" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _ex( 'Cannot Activate', 'theme' ); ?></a>
+					<# } #>
+					<# if ( data.customize_url ) { #>
+						<a class="button disabled"><?php _e( 'Live Preview' ); ?></a>
+					<# } else { #>
+						<button class="button disabled"><?php _e( 'Preview' ); ?></button>
+					<# } #>
 				<# } #>
 			<# } else { #>
 				<?php
diff --git a/wp-admin/themes.php b/wp-admin/themes.php
index d1c1197618..b9df71b70f 100644
--- a/wp-admin/themes.php
+++ b/wp-admin/themes.php
@@ -353,7 +353,7 @@ foreach ( $themes as $theme ) :
 			<?php if ( $theme['actions']['customize'] && current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) { ?>
 				<a class="button button-primary customize load-customize hide-if-no-customize" href="<?php echo $theme['actions']['customize']; ?>"><?php _e( 'Customize' ); ?></a>
 			<?php } ?>
-		<?php } else { ?>
+		<?php } elseif ( $theme['compatibleWP'] && $theme['compatiblePHP'] ) { ?>
 			<?php
 			/* translators: %s: Theme name. */
 			$aria_label = sprintf( _x( 'Activate %s', 'theme' ), '{{ data.name }}' );
@@ -362,6 +362,15 @@ foreach ( $themes as $theme ) :
 			<?php if ( current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) { ?>
 				<a class="button button-primary load-customize hide-if-no-customize" href="<?php echo $theme['actions']['customize']; ?>"><?php _e( 'Live Preview' ); ?></a>
 			<?php } ?>
+		<?php } else { ?>
+			<?php
+			/* translators: %s: Theme name. */
+			$aria_label = sprintf( _x( 'Cannot Activate %s', 'theme' ), '{{ data.name }}' );
+			?>
+			<a class="button disabled" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _ex( 'Cannot Activate', 'theme' ); ?></a>
+			<?php if ( current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) { ?>
+				<a class="button button-primary hide-if-no-customize disabled"><?php _e( 'Live Preview' ); ?></a>
+			<?php } ?>
 		<?php } ?>
 
 		</div>
@@ -518,12 +527,21 @@ if ( ! is_multisite() && $broken_themes ) {
 					<a class="button button-primary customize load-customize hide-if-no-customize" href="{{{ data.actions.customize }}}"><?php _e( 'Customize' ); ?></a>
 				<# } #>
 			<# } else { #>
-				<?php
-				/* translators: %s: Theme name. */
-				$aria_label = sprintf( _x( 'Activate %s', 'theme' ), '{{ data.name }}' );
-				?>
-				<a class="button activate" href="{{{ data.actions.activate }}}" aria-label="<?php echo $aria_label; ?>"><?php _e( 'Activate' ); ?></a>
-				<a class="button button-primary load-customize hide-if-no-customize" href="{{{ data.actions.customize }}}"><?php _e( 'Live Preview' ); ?></a>
+				<# if ( data.compatibleWP && data.compatiblePHP ) { #>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( _x( 'Activate %s', 'theme' ), '{{ data.name }}' );
+					?>
+					<a class="button activate" href="{{{ data.actions.activate }}}" aria-label="<?php echo $aria_label; ?>"><?php _e( 'Activate' ); ?></a>
+					<a class="button button-primary load-customize hide-if-no-customize" href="{{{ data.actions.customize }}}"><?php _e( 'Live Preview' ); ?></a>
+				<# } else { #>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( _x( 'Cannot Activate %s', 'theme' ), '{{ data.name }}' );
+					?>
+					<a class="button disabled" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _ex( 'Cannot Activate', 'theme' ); ?></a>
+					<a class="button button-primary hide-if-no-customize disabled"><?php _e( 'Live Preview' ); ?></a>
+				<# } #>
 			<# } #>
 		</div>
 	</div>
@@ -592,14 +610,25 @@ if ( ! is_multisite() && $broken_themes ) {
 				<?php echo implode( ' ', $current_theme_actions ); ?>
 			</div>
 			<div class="inactive-theme">
-				<?php
-				/* translators: %s: Theme name. */
-				$aria_label = sprintf( _x( 'Activate %s', 'theme' ), '{{ data.name }}' );
-				?>
-				<# if ( data.actions.activate ) { #>
-					<a href="{{{ data.actions.activate }}}" class="button activate" aria-label="<?php echo $aria_label; ?>"><?php _e( 'Activate' ); ?></a>
+				<# if ( data.compatibleWP && data.compatiblePHP ) { #>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( _x( 'Activate %s', 'theme' ), '{{ data.name }}' );
+					?>
+					<# if ( data.actions.activate ) { #>
+						<a href="{{{ data.actions.activate }}}" class="button activate" aria-label="<?php echo $aria_label; ?>"><?php _e( 'Activate' ); ?></a>
+					<# } #>
+					<a href="{{{ data.actions.customize }}}" class="button button-primary load-customize hide-if-no-customize"><?php _e( 'Live Preview' ); ?></a>
+				<# } else { #>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( _x( 'Cannot Activate %s', 'theme' ), '{{ data.name }}' );
+					?>
+					<# if ( data.actions.activate ) { #>
+						<a class="button disabled" aria-label="<?php echo $aria_label; ?>"><?php _ex( 'Cannot Activate', 'theme' ); ?></a>
+					<# } #>
+					<a class="button button-primary hide-if-no-customize disabled"><?php _e( 'Live Preview' ); ?></a>
 				<# } #>
-				<a href="{{{ data.actions.customize }}}" class="button button-primary load-customize hide-if-no-customize"><?php _e( 'Live Preview' ); ?></a>
 			</div>
 
 			<# if ( ! data.active && data.actions['delete'] ) { #>
diff --git a/wp-includes/customize/class-wp-customize-theme-control.php b/wp-includes/customize/class-wp-customize-theme-control.php
index 10f09d180b..9c5e7602cf 100644
--- a/wp-includes/customize/class-wp-customize-theme-control.php
+++ b/wp-includes/customize/class-wp-customize-theme-control.php
@@ -121,7 +121,11 @@ class WP_Customize_Theme_Control extends WP_Customize_Control {
 				<div class="theme-id-container">
 					<h3 class="theme-name" id="{{ data.section }}-{{ data.theme.id }}-name">{{ data.theme.name }}</h3>
 					<div class="theme-actions">
-						<button type="button" class="button button-primary preview-theme" aria-label="<?php echo esc_attr( $preview_label ); ?>" data-slug="{{ data.theme.id }}"><?php _e( 'Live Preview' ); ?></button>
+						<# if ( data.theme.compatibleWP && data.theme.compatiblePHP ) { #>
+							<button type="button" class="button button-primary preview-theme" aria-label="<?php echo esc_attr( $preview_label ); ?>" data-slug="{{ data.theme.id }}"><?php _e( 'Live Preview' ); ?></button>
+						<# } else { #>
+							<button type="button" class="button button-primary disabled" aria-label="<?php echo esc_attr( $preview_label ); ?>"><?php _e( 'Live Preview' ); ?></button>
+						<# } #>
 					</div>
 				</div>
 				<div class="notice notice-success notice-alt"><p><?php _ex( 'Installed', 'theme' ); ?></p></div>
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 1dc5c04c8a..b8add0c608 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.5-alpha-47815';
+$wp_version = '5.5-alpha-47816';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.